Renovate EUVD-2026-101750

Exploitation requires a self-hosted Renovate instance running a version before 44.60.1 that is configured to extend an externally sourced shared preset under attacker control (e.g., a third-party or community preset referenced via extends/presets). The core precondition is that the restricted env allowlist (allowedEnv) is relied upon as a security boundary while consuming untrusted presets - the attacker places an env block inside the shared preset to override variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO that the allowlist is supposed to restrict. Limiting factors: the attack does NOT work against instances that only use first-party/trusted presets, and it does not apply to the hosted Mend Renovate app in the same way (the advisory scopes impact to self-hosted instances); PR:L indicates the attacker needs a legitimate foothold (a repository/preset the instance already trusts or onboards) rather than purely anonymous network access.

This is a genuine high-priority issue for the specific population it affects, but that population is narrow. The input CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N) with full high impact to both the vulnerable system and subsequent systems (VC/VI/VA:H, SC/SI/SA:H) yields a 9.0 Critical, and that is believable: overriding PATH/LD_PRELOAD/NODE_OPTIONS in child processes of a self-hosted CI/automation bot is effectively arbitrary code execution on the runner, which is why the subsequent-system (SC/SI/SA:H) metrics are set. However, several signals temper real-world urgency. The AT:P (attack requirements present) metric is doing heavy lifting - exploitation is NOT 'default-config remote unauthenticated'; it requires the target self-hosted instance to extend an attacker-controlled externally sourced preset, and PR:L indicates some legitimate standing (an onboarded repository/tenant) is needed. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or weaponization - exploitation status is 'no public exploit identified at time of analysis.' Net: a legitimately dangerous authorization flaw gated behind a non-default trust relationship (consuming third-party presets), so prioritize patching for self-hosted Renovate operators who extend external presets, but this is not an internet-wide spray-and-pray threat. Note one conflict to verify: the input tag says 'Authentication Bypass' while CWE-863 and the description describe an authorization/allowlist bypass, not an authentication bypass.

A self-hosted Renovate operator configures repositories to extend a shared config preset hosted on an external repository the attacker controls. The attacker adds an env block inside that preset that sets restricted variables such as LD_PRELOAD or NODE_OPTIONS, bypassing the allowedEnv allowlist; when Renovate spawns child processes (package managers, git), the injected variables execute attacker-controlled code on the self-hosted runner. No public exploit was identified in the provided data.