External risk intelligence

Renovate Allowlist Bypass via Shared Preset Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-110867

Renovate is a build-time dependency automation tool typically run within private CI/CD pipelines or developer-controlled environments. While self-hosted instances may be network-reachable, they are generally not public-facing internet services. Exploitation requires control over an externally sourced preset used by the bot, making direct public internet exposure uncommon in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability in Renovate, a tool used for automating dependency updates. The issue allows for the bypass of restrictions on environment variables, potentially enabling the override of critical variables within child processes on self-hosted instances. This could impact the security and integrity of automated development workflows.

Bypass restrictions on important environment variables.
Critical for secure automated software updates.
Confirm if self-hosted Renovate instances are affected.

Attack Path

How an attacker could exploit the issue

An attacker with collaborator-level access to a repository can compromise Renovate instances by providing a malicious preset. This preset, when processed by Renovate, can override critical environment variables, allowing the attacker to influence how subsequent processes run on self-hosted Renovate instances. This could lead to the execution of arbitrary code or other malicious actions within the Renovate environment.

Requires collaborator access to a repository.
Triggered by an externally sourced preset.
Risks environment variable override.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker controlling an externally sourced preset could override sensitive environment variables within child processes on self-hosted Renovate instances. This could potentially impact system behavior and the security of the execution environment.

Repository environment variables are at risk.
Attackers can override variables via presets.
Compromised child process execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

In a real-world scenario, the platform or infrastructure team responsible for managing Renovate bot deployments on self-hosted instances would likely own this issue. Initial steps should focus on identifying all Renovate instances, assessing their reachability and business criticality, and confirming the accountable owner before planning remediation.

Platform or infrastructure team ownership.
Verify Renovate instance reachability and criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Renovate and why do developers use it?

Renovate is an automated dependency management tool that monitors software projects for outdated packages. It automatically generates pull requests to update dependencies, helping developers keep their applications secure and up-to-date with minimal manual effort. It is frequently deployed as a self-hosted bot within development workflows to manage updates across multiple repositories.

How does CVE-2026-110867 allow an allowlist bypass?

This vulnerability, classified as CWE-863 (Incorrect Authorization), happens because Renovate fails to properly enforce restrictions on environment variables. An attacker can craft a malicious shared preset that forces the system to accept restricted variables. This allows unauthorized overrides of critical settings, such as PATH or NODE_OPTIONS, affecting how the software functions internally.

Do I need an external preset to trigger this vulnerability?

Yes, triggering this flaw requires the use of an externally sourced preset. The vulnerability occurs when Renovate processes these configurations and fails to sanitize them. It is not triggered by standard, internal, or trusted configuration files that do not utilize external preset sources to override environment variables.

Is my Renovate instance likely to be exposed to this threat?

According to Halo Surface Signal, direct exposure is unlikely for most setups. Because Renovate typically operates within private CI/CD pipelines rather than as a public-facing internet service, the barrier for an attacker is higher. You should focus on instances that process presets from untrusted or external sources, as these are the primary vectors for this type of compromise.

What is the first step to address this CVE?

Start by identifying all self-hosted Renovate instances within your infrastructure. Once you have a clear inventory, determine if those instances process external presets from untrusted repositories. Coordinate with your platform or infrastructure team to verify the software version and prepare for an update to version 44.60.1 or later to resolve the underlying configuration logic error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.