Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.0
CVE-2026-110867: Renovate before 44.60.1 lets attackers change environment variables
CVE-2026-110867 · published 1 day ago
Summary
Self‑hosted Renovate instances (including the community and enterprise editions) can be tricked into using a shared preset that modifies restricted environment settings such as PATH or security‑related variables. An attacker who can supply that preset could influence the commands the tool runs, potentially compromising the host system. Update Renovate to version 44.60.1 or later to block this bypass.
What to do
- Update renovatebot renovate to version 44.60.1 or later.
- Update mend renovate-ce to version 15.5.0 or later.
- Update mend renovate-ee-server to version 15.5.0 or later.
- Update mend renovate-ee-worker to version 15.5.0 or later.
- Update mend mend-renovate-ce helm chart to version 15.5.0 or later.
- Update mend mend-renovate-enterprise-edition helm chart to version 10.5.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| renovatebot | renovate | < 44.60.1 |
| mend | renovate-ce | < 15.5.0 |
| mend | renovate-ee-server | < 15.5.0 |
| mend | renovate-ee-worker | < 15.5.0 |
| mend | mend-renovate-ce helm chart | < 15.5.0 |
| mend | mend-renovate-enterprise-edition helm chart | < 10.5.0 |
Original advisory text
Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
References
- https://github.com/renovatebot/renovate/security/advisories/GHSA-6873-xr44-22vm
- https://www.vulncheck.com/advisories/renovate-before-44.60.1-allowedenv-allowlis...
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-1108... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-110867 Vendor Advisory
- https://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-863Incorrect Authorization
Timeline
Published14 Oct 2026
Updated16 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-110867 · NVD
CVE-2026-110867 · MITRE
CVE-2026-110867 · OSV
GHSA-6873-xr44-22vm · GHSA
Track software like this
Free during beta