Renovate: Allowlist bypass allows overriding restricted environment variables
Summary
Renovate, a tool for automated dependency updates, lets a repository bypass the allowedEnv allowlist by placing env settings inside a shared preset. An attacker who controls an externally sourced preset can override variables such as PATH, LD_PRELOAD, NODE_OPTIONS or GIT_SSL_CAINFO in child processes on self-hosted instances. The CNA rates it critical (CVSS 9.0, v4.0), while the vendor advisory gives 9.9 (CVSS v3.1).
Affected
- renovatebot/renovate (npm and Docker): versions before 44.60.1
- Mend renovate-ce, renovate-ee-server and renovate-ee-worker: versions before 15.5.0
- Mend mend-renovate-ce Helm chart: versions before 15.5.0
- Mend mend-renovate-enterprise-edition Helm chart: versions before 10.5.0
Fixed in
- renovatebot/renovate: 44.60.1
- Mend renovate-ce, renovate-ee-server, renovate-ee-worker and mend-renovate-ce Helm chart: 15.5.0
- Mend mend-renovate-enterprise-edition Helm chart: 10.5.0
Workaround
- None stated in the vendor advisory.
- Interim measure, not vendor guidance: only use presets from sources you control and review external extends entries.
- Restrict who can change repository configuration.
Exploitation
- No exploitation known in the sources reviewed.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- Not listed in CISA KEV according to one aggregator.
- No public proof of concept found; absence in search results is not proof that none exists.
Our recommendation
- Upgrade self-hosted Renovate to 44.60.1 or later, and Mend editions and Helm charts to the fixed versions above. The same release also fixes CVE-2026-110865.
- Until patched, use presets from trusted sources only.
- Check whether your instances pull external presets and whether runners hold CI secrets or tokens.
- Prioritise this update for self-hosted instances that use third-party presets.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6873-xr44-22vm github.com
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-110867 osv.dev
- CyStack vulnerability database entry cystack.net
- Strix CVE entry www.strix.ai
- VulDB CVE entry vuldb.com
- Vulners PT-2026-114181 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 08:07.
Original description (NVD)
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.