Renovate: Server-side request forgery via HTTP presets and customDatasources

Summary

Renovate before 44.79.0 allows users with the ability to change configuration to make its shared HTTP client request arbitrary internal URLs through extends presets or customDatasources. An attacker can point a preset at a cloud instance metadata service to obtain AWS credentials, or leak sensitive data through Renovate logs. The attack requires low privileges, such as a repository contributor who can influence Renovate configuration, and no user interaction.

Affected

• Renovate (npm, Docker images renovate/renovate, renovatebot/renovate): versions before 44.79.0
• Mend renovate-ce, renovate-ee-server, renovate-ee-worker: versions before 15.6.0 (per CVE record; not verified against Mend's advisory)
• Mend Helm charts: mend-renovate-ce before 15.6.0; mend-renovate-enterprise-edition before 10.6.0 (per CVE record; not verified against Mend's advisory)

Fixed in

• Renovate 44.79.0 or later
• Mend products: 15.6.0 or later (renovate-ce, renovate-ee-server, renovate-ee-worker); check Mend's release notes for exact versions
• Mend Helm charts: see Mend's release notes

Workaround

• No vendor workaround documented; the vendor advisory lists none.
• Third-party recommendation (VulDB): review configuration files and ensure that presets and datasources come only from fully trusted and verified sources.
• Restrict who can change Renovate configuration and presets, and block access from the Renovate runner to the cloud metadata endpoint where possible.

Exploitation

• Not known to be exploited in the wild; not listed in CISA KEV.
• CISA SSVC assessment: exploitation none, not automatable.
• No public proof of concept found in our searches; this is not a confirmed absence.

Our recommendation

• Upgrade Renovate to 44.79.0 or later, and Mend products to their fixed versions from Mend's advisory.
• Review who can change Renovate configuration, presets and custom datasources, and limit write access to repositories.
• Restrict metadata service access (for example IMDSv2 with hop limit) from Renovate runners and rotate credentials if exposure is suspected.
• Review Renovate logs for unexpected internal URL requests.
• Priority is highest for self-hosted Renovate in cloud environments with broad repository write access.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-8rqp-w6vc-pf27 github.com
• VulnCheck advisory www.vulncheck.com
• OSV entry CVE-2026-110868 osv.dev
• VulDB CVE-2026-110868 vuldb.com
• OpenCVE CVE-2026-110868 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:25.