CVE-2026-110865

7.1 HIGHpublic exploit available

Published 2026-10-14 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers to inject custom HTTP headers into requests Renovate sends to other hosts.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Weaknesses

CWE-424

Public exploit & PoC references

https://github.com/renovatebot/renovate/security/advisories/GHSA-6j6f-fh7w-vvjr

All references

https://github.com/renovatebot/renovate/security/advisories/GHSA-6j6f-fh7w-vvjr
https://www.vulncheck.com/advisories/renovate-before-44.60.1-http-header-allowlist-bypass-via-shared-presets

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-107352
MEDIUMCVE-2026-69979
MEDIUMCVE-2026-89039
MEDIUMCVE-2026-93353

Related by shared AI tags and CWE weakness class. Browse the full archive.