{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-110866", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-14T22:18:33.239Z", "datePublished": "2026-10-14T22:52:53.970Z", "dateUpdated": "2026-10-14T22:52:53.970Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-14T22:52:53.970Z"}, "datePublic": "2026-09-29T00:00:00.000Z", "title": "Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request", "descriptions": [{"lang": "en", "value": "Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Protection Mechanism Failure", "cweId": "CWE-693", "type": "CWE"}]}], "affected": [{"vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "packageURL": "pkg:npm/renovate", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "44.61.3"}]}, {"vendor": "mend", "product": "renovate-ce", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.5.0"}]}, {"vendor": "mend", "product": "renovate-ee-server", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.5.0"}]}, {"vendor": "mend", "product": "renovate-ee-worker", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.5.0"}]}, {"vendor": "mend", "product": "mend-renovate-ce helm chart", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.5.0"}]}, {"vendor": "mend", "product": "mend-renovate-enterprise-edition helm chart", "defaultStatus": "unaffected", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "10.5.0"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-2frq-pm48-6j4h)"}, {"name": "VulnCheck Advisory: Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/renovate-before-44.61.3-minimumreleaseage-bypass-via-pr-rebase-request"}], "credits": [{"lang": "en", "value": "mjnagel", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/renovate", "product": "renovate", "vendor": "renovatebot", "versions": [{"lessThan": "44.61.3", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "renovate-ce", "vendor": "mend", "versions": [{"lessThan": "15.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "renovate-ee-server", "vendor": "mend", "versions": [{"lessThan": "15.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "renovate-ee-worker", "vendor": "mend", "versions": [{"lessThan": "15.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "mend-renovate-ce helm chart", "vendor": "mend", "versions": [{"lessThan": "15.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "mend-renovate-enterprise-edition helm chart", "vendor": "mend", "versions": [{"lessThan": "10.5.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses."}], "id": "CVE-2026-110866", "lastModified": "2026-10-14T23:17:28.253", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-10-14T23:17:28.253", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/renovate-before-44.61.3-minimumreleaseage-bypass-via-pr-rebase-request"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-693"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "renovate: Renovate: Protection mechanism bypass via pull request rebase", "id": "2552993", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2552993"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-841", "details": ["Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.", "A flaw was found in Renovate. This protection mechanism bypass occurs when a user triggers a pull request rebase using the rebase or retry checkbox, causing minimum package release age checks to be skipped. Consequently, an attacker who publishes a malicious dependency version can have untrusted code incorporated into automated pull requests and executed in Continuous Integration (CI) pipelines before the designated waiting period elapses."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Renovate upstream addressed this issue in version 44.61.3; updating to a Renovate release that includes this fix, such as a Konflux mintmaker-renovate-image build containing it, resolves the issue."}, "name": "CVE-2026-110866", "public_date": "2026-10-14T22:52:53Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-110866\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-110866\nhttps://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h\nhttps://www.vulncheck.com/advisories/renovate-before-44.61.3-minimumreleaseage-bypass-via-pr-rebase-request"], "statement": "A MODERATE severity protection mechanism bypass was found in Renovate, which Red Hat ships in Konflux as part of the mintmaker-renovate-image container image used by the Mint Maker dependency-update service. When a user requests a rebase of a Renovate pull request using the rebase/retry checkbox, Renovate skips the configured minimumReleaseAge checks and updates the targeted dependency to its latest published version. Consequently, an attacker who publishes a malicious dependency version to a public package registry can have that untrusted version incorporated into an automated pull request and executed in Continuous Integration (CI) pipelines before the designated waiting period elapses. Exploitation requires user interaction, since a repository maintainer or collaborator must trigger the rebase, and the direct impact is limited to integrity, with no direct effect on confidentiality or availability. Red Hat rates this flaw as MODERATE, consistent with the upstream CVSS v3.1 score of 4.7. The fix for the Konflux mintmaker-renovate-image component is deferred because the impact is MODERATE with a CVSS score below 7.0; until a fixed image is shipped, the residual risk remains that a user-requested rebase can bypass the minimumReleaseAge protection and pull a dependency version newer than the configured release age into a pull request and CI environment.", "threat_severity": "Moderate"}

{"created": "2026-10-15T12:30:04.658476+00:00", "updated": "2026-10-15T12:30:04.658482+00:00", "vendors": []}