CVE-2026-110865
HIGH
CVSS 7.1
Published: 2026-10-14
Modified: 2026-10-16
Tenable Plugin
Checking the public Tenable catalog…
Threat Intelligence Pending
IOCs, MITRE ATT&CK techniques, and attack chain data are being generated. Refresh in a few seconds.
Description
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.
Quick Facts
| CVE ID | CVE-2026-110865 |
| CVSS Score | 7.1 |
| Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N |
| Published | 2026-10-14 |
| Exploited | No |
| CISA KEV | No |
| PoC | Not public |