CVE-2026-110868 renovatebot CVE debrief

Who should care

Defenders responsible for systems using Renovate, especially those with internal services that could be accessed via SSRF, should assess exposure and potential impact. This includes evaluating if internal URLs could be accessed via the shared HTTP client and verifying versions and configurations of Renovate in use.

Why it matters

CVE-2026-110868 is a high-severity SSRF vulnerability in Renovate before 44.79.0, allowing attackers to make arbitrary internal URL requests. Defenders should verify exposure, assess potential impact, and update to version 44.79.0 or later.

• Potential unauthorized access to internal services via SSRF.
• Possible leakage of sensitive information, such as AWS credentials.
• Potential disruption of internal services if exploited.
• Need for verification of exposure and assessment of potential impact.

Technical summary

The Renovate application before version 44.79.0 contains a server-side request forgery (SSRF) vulnerability. This vulnerability allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. An attacker could exploit this by pointing a preset at an instance metadata service endpoint to obtain sensitive information, such as AWS credentials, or leak sensitive information through Renovate logs.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems using Renovate versions before 44.79.0.

Recommended defensive actions

• Verify if systems using Renovate are exposed to the vulnerability by checking versions and configurations.
• Assess potential impact by evaluating if internal URLs could be accessed via the shared HTTP client.
• Update Renovate to version 44.79.0 or later to remediate the vulnerability.
• Monitor logs for potential sensitive information leaks or unauthorized internal URL access.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the SSRF vulnerability in Renovate before 44.79.0, allowing users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.