Vulnerability · Published Oct 14, 2026 · Assigned by VulnCheck

CVE-2026-110865Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

High 7.1

In plain English

A high-severity security flaw in mend-renovate-ce helm chart from mend. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 91.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

Affected products (as reported)

Vendor	Product	Versions
renovatebot	renovate	0 – before 44.60.1
mend	renovate-ce	0 – before 15.5.0
mend	renovate-ee-server	0 – before 15.5.0
mend	renovate-ee-worker	0 – before 15.5.0
mend	mend-renovate-ce helm chart	0 – before 15.5.0
mend	mend-renovate-enterprise-edition helm chart	0 – before 10.5.0

Weakness: CWE-424 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-6j6f-fh7w-vvjr) vendor-advisory
VulnCheck Advisory: Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets third-party-advisory