Act nowDisclosed

Advisory · CVE-2026-110867

Renovate preset flaw lets repositories set restricted environment variables

Renovate before 44.60.1 lets a shared preset set restricted environment variables, which can affect child processes on self-hosted instances. CVSS 3.1 8.5, CVSS 4.0 9.0.

Advisory published October 15, 2026Independent summary
Vendor
Renovate
Product
Renovate
Identifier / CWE
CVE-2026-110867
CWE-863
Action timing
Immediate
ELI5

Explain it like I’m five

A shared settings file can quietly set the environment the worker runs in, including where it looks for programs.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01External preset used

    A repository uses a shared preset sourced from outside its own trust boundary.

  2. 02Environment placed in preset

    The preset contains environment entries that should be restricted to administrators.

  3. 03Allowlist bypassed

    Renovate accepts the entries through the preset path instead of blocking them.

  4. 04Child processes affected

    Variables such as PATH or loader and runtime options can affect child processes on self-hosted instances.

What happened

The GitHub advisory for Renovate describes an allowlist bypass before 44.60.1: repositories can set restricted environment variables by placing them inside a shared preset. The NVD record also lists Mend Renovate community and enterprise packages before their corresponding fixed releases.

Attackers controlling an externally sourced preset can override variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.

What to do

  1. Inventory self-hosted Renovate instances and Mend Renovate deployments and their preset sources.
  2. Upgrade Renovate to 44.60.1 or later, or the corresponding fixed Mend release, using the advisory guidance.
  3. Freeze use of new external presets until the upgrade is complete.
  4. Review presets in use for environment entries and review worker logs for unexpected child process behaviour.
  5. Rotate credentials available to Renovate workers if a malicious preset may have run, and verify deployed versions after patching.

Management note

Renovate workers hold broad repository credentials by design. A preset that can shape the worker environment is a supply chain issue, not just a configuration bug.