CVE-2026-110868: falha de alta gravidade em renovatebot renovate
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.4epss 0.2%
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Produtos afetados
mend · mend-renovate-ce helm chartmend · mend-renovate-enterprise-edition helm chartmend · renovate-cemend · renovate-ee-servermend · renovate-ee-workerrenovatebot · renovateCVEs relacionadas — renovatebot renovate
No mesmo produto, das mais perigosas para as menos.
CVE-2026-88889HIGHRenovate before 44.14.7 Command Injection via distributionTypeEPSS 1.0%CVE-2026-76228HIGHRenovate before 42.68.5 Remote Code Execution via Gradle WrapperEPSS 1.0%CVE-2026-88888HIGHRenovate before 44.14.7 Command Injection via Mix organizationEPSS 0.9%CVE-2026-88885HIGHRenovate before 44.14.7 Command Injection via depNameEPSS 0.9%CVE-2026-88880CRITICALRenovate before 44.11.3 Credential Exfiltration via Link HeaderEPSS 0.5%CVE-2026-88887CRITICALRenovate before 44.11.2 Credential Exfiltration via Link HeaderEPSS 0.4%