Renovate EUVD-2026-101749

Exploitation requires that the target repository runs Renovate (before 44.61.3) with the minimumReleaseAge protection configured, that the attacker can publish a malicious version to a registry for a dependency the repo consumes, and that a maintainer actively triggers a PR rebase/retry via the checkbox - the UI:P interaction that defeats the quarantine. Limiting factors: minimumReleaseAge is a non-default hardening control (repos without it are unaffected by this specific bypass), the attack depends on a human rebase action rather than being fully automatic, and impact is confined to running attacker-controlled dependency code in CI rather than direct host compromise.

This is a genuine but modest-severity integrity issue, not a top-tier emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N, score 5.3 Medium) is internally consistent with the description: network-reachable, low complexity, no privileges, but requiring passive user interaction (a maintainer clicking the rebase/retry checkbox), with only limited integrity impact and no confidentiality or availability impact. No EPSS score, no CISA KEV listing, and no POC indicator are present in the provided data, so there is no evidence of active or at-scale exploitation - exploitation status is 'no public exploit identified at time of analysis.' The real risk is a supply-chain timing bypass: the minimumReleaseAge control exists specifically to quarantine freshly published (and potentially malicious or compromised) dependency versions, and this flaw lets an attacker collapse that quarantine window. The 'Authentication Bypass' tag is misleading - this is a protection-mechanism bypass (CWE-693) of a release-age safety gate, with PR:N confirming no authentication is involved at all. Net: prioritize for teams that rely on minimumReleaseAge as a defense against dependency-confusion/compromised-package attacks, but it is not a drop-everything network RCE.

An attacker publishes a malicious version of a dependency the target repository consumes. Renovate opens or holds a PR, and when a maintainer clicks the rebase/retry checkbox, the minimumReleaseAge quarantine is skipped and the malicious version is pushed into the PR and executed in CI before the intended waiting period elapses. No public exploit code is identified at time of analysis, and success depends on the maintainer triggering a rebase.