Renovate CVE-2026-110865

Exploitation requires the attacker to be an authorized repository user able to introduce or reference a shared Renovate preset (internal or externally sourced) containing hostRules[].headers. The specific enabling condition is Renovate's use of the hostRules headers feature combined with an allowedHeaders restriction that the preset path fails to enforce - the vulnerability lies in presets evading that allowlist. Limiting factors: the affected version must be before 44.60.1, the attacker needs write/config influence over the repository or its preset sources (PR:L), and the attack is condition-dependent (CVSS AC:H/AT:P), making it an insider or supply-chain-style abuse rather than anonymous remote exploitation.

This is a moderate-priority authorization/allowlist bypass, not a critical remote-code flaw. The only severity signal provided is a CVSS 4.0 vector scoring 7.1 (AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N). Three factors meaningfully dampen real-world risk: AC:H and AT:P indicate the attack is not trivially repeatable and depends on specific conditions, and PR:L confirms the attacker must already be an authorized repository user who can influence Renovate configuration/presets - this is an insider/supply-chain abuse vector, not anonymous internet exploitation. The elevated score is driven by VC:H and SC:H, reflecting that injected headers (e.g. credentials or auth tokens Renovate holds) can leak to other/attacker-controlled hosts, impacting a subsequent system. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no evidence of active exploitation or weaponization - risk is latent and theoretical at this time. No conflicting signals are present; the primary limitation is the sparse intelligence (two advisory references only, no exploitation telemetry).

A user with repository/config access references a shared Renovate preset (internal or externally sourced) that defines hostRules[].headers. Because these preset-supplied headers are not validated against the allowedHeaders restriction, Renovate injects the attacker-chosen HTTP headers into outbound requests to other hosts, potentially forwarding credentials or auth tokens to an attacker-controlled endpoint. No public exploit identified at time of analysis; exploitation requires some privileges and specific conditions (CVSS AC:H/AT:P/PR:L).