Renovate EUVD-2026-101751

Requires the ability to supply or influence Renovate's configuration - specifically an 'extends' preset reference or a 'customDatasources' entry whose URL the attacker controls (e.g. by having write access to a repository Renovate scans, or by controlling a preset source it resolves). The high-value outcome (AWS credential theft) additionally requires Renovate to be running in a cloud environment that exposes an instance metadata service (such as the AWS IMDS endpoint 169.254.169.254); in environments without a reachable metadata/internal endpoint the impact is reduced to internal information disclosure via logs. Limiting factors: the attacker needs configuration-level influence (not fully unauthenticated), and real impact depends on the deployment's network reachability of internal/metadata services. Fixed in Renovate 44.79.0.

This is a credible, actionable risk rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity, authenticated attack with no user interaction, and the high confidentiality impact on both the vulnerable and subsequent system (VC:H/SC:H) is consistent with the described outcome: SSRF reaching a cloud instance metadata service to steal AWS credentials. The realistic severity, however, is gated by PR:L - the attacker must be able to supply or influence Renovate configuration (extends presets or customDatasources), typically meaning write access to a repository Renovate processes or control over a referenced preset source. No EPSS score, CISA KEV listing, or POC is present in the provided data: exploitation status is therefore 'no public exploit identified at time of analysis,' and there is no evidence of active exploitation. The main conflict to flag is between the network attack vector and the real-world precondition of config/repo influence - a defender should treat the exposure as highest for self-hosted Renovate instances running in cloud environments (where a metadata endpoint exists) that process untrusted or multi-tenant repositories. EPSS/KEV/POC are all absent, so confidence in the likelihood signal is limited to the CVSS-derived reasoning.

An attacker with the ability to modify Renovate configuration in a processed repository (or to host a malicious extends preset it pulls) sets a preset or customDatasource URL pointing at the cloud instance metadata endpoint (e.g. 169.254.169.254). When the shared HTTP client fetches it, Renovate retrieves AWS credentials or other internal data and exposes them via its logs. No public POC is listed in the provided data.