CVE-2026-110866mediumCWE-693

CVE-2026-110866: falha de média gravidade em renovatebot renovate

Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar renovate+ Monitorar renovate-ce

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
Produtos afetados
mend · mend-renovate-ce helm chartmend · mend-renovate-enterprise-edition helm chartmend · renovate-cemend · renovate-ee-servermend · renovate-ee-workerrenovatebot · renovate
CVEs relacionadas — renovatebot renovate

No mesmo produto, das mais perigosas para as menos.

CVE-2026-88889HIGHRenovate before 44.14.7 Command Injection via distributionTypeEPSS 1.0%CVE-2026-76228HIGHRenovate before 42.68.5 Remote Code Execution via Gradle WrapperEPSS 1.0%CVE-2026-88888HIGHRenovate before 44.14.7 Command Injection via Mix organizationEPSS 0.9%CVE-2026-88885HIGHRenovate before 44.14.7 Command Injection via depNameEPSS 0.9%CVE-2026-88880CRITICALRenovate before 44.11.3 Credential Exfiltration via Link HeaderEPSS 0.5%CVE-2026-88887CRITICALRenovate before 44.11.2 Credential Exfiltration via Link HeaderEPSS 0.4%