High priorityDisclosed

Advisory · CVE-2026-110868

Renovate preset and datasource flaw enables server-side requests to internal URLs

Renovate before 44.79.0 can be pointed at arbitrary internal URLs through presets or custom datasources, exposing internal services and cloud metadata. CVSS 3.1 8.5.

Advisory published October 15, 2026Independent summary
Vendor
Renovate
Product
Renovate
Identifier / CWE
CVE-2026-110868
CWE-918
Action timing
Immediate
ELI5

Explain it like I’m five

The update bot can be handed an internal address and will happily go and fetch it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Preset or datasource supplied

    A user supplies an extends preset or a custom datasource definition.

  2. 02Internal URL set

    The definition points the shared HTTP client at an arbitrary internal URL.

  3. 03Request made by Renovate

    Renovate requests that URL from its server-side position.

  4. 04Internal response exposed

    Responses, including possible cloud metadata, can leak sensitive information through Renovate output or logs.

What happened

The GitHub advisory for Renovate describes server-side request forgery before 44.79.0 through extends presets or custom datasources that make the shared HTTP client request arbitrary internal URLs. The NVD record also lists Mend Renovate community and enterprise packages before their corresponding fixed releases.

Attackers can point a preset at an instance metadata endpoint to obtain cloud credentials or leak sensitive information through Renovate logs.

What to do

  1. Inventory self-hosted Renovate instances and Mend Renovate deployments, and list the presets and custom datasources they accept.
  2. Upgrade Renovate to 44.79.0 or later, or the corresponding fixed Mend release, using the advisory guidance.
  3. Block Renovate workers from reaching link-local metadata addresses and unrelated internal services at the network layer.
  4. Review Renovate logs for requests to internal addresses, metadata endpoints, or unusual preset URLs.
  5. Rotate cloud credentials for any worker that may have fetched a metadata endpoint, and verify deployed versions after patching.

Management note

This pairs patching with network controls. Even a patched bot should not have an open path to cloud metadata from a job that only needs package registries.