CVE-2026-110865 is a High severity (CVSS 7.1) allowlist bypass in Renovate before 44.60.1. Header rules placed inside a shared preset skip validation, so custom headers can be sent to other hosts. Upgrade Renovate to 44.60.1, or Mend Renovate CE and EE to 15.5.0.
What's affected
The record says Renovate before 44.60.1 is affected. The GitHub advisory is more detailed. It lists the npm package renovate and the Docker images renovate/renovate below 44.60.1, patched at 44.60.1. It lists Mend Renovate Community and Enterprise edition images, including the server and worker, below 15.5.0, patched at 15.5.0. The Helm chart mend-renovate-ce is listed below 15.5.0, and mend-renovate-enterprise-edition below 10.5.0, patched at 10.5.0.
The weakness is CWE-424, improper protection of an alternate path. Per the advisory, a self-hosted administrator can limit which HTTP headers a repository may set through the allowedHeaders option. A repository could get around that by putting the host rules with headers inside a shared preset, where they were not validated.
Severity differs by source. The record and VulnCheck give 7.1. The GitHub advisory is labelled High. They agree.
How to check if you're exposed
You are in scope if you run a self-hosted Renovate and you limit headers with allowedHeaders. The advisory frames the impact for self-hosted administrators who restrict the headers that users can set.
Check your version.
npx renovate --version
For containers, check the image tag against 44.60.1 for the community image, and 15.5.0 for the Mend images. Then look at your presets, both internal ones and ones from external sources. A preset that declares host rules with headers should be reviewed. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Upgrade the npm package or Docker image to Renovate 44.60.1 or later.
- Upgrade Mend Renovate CE and EE images to 15.5.0 or later, and the enterprise Helm chart to 10.5.0 or later.
- Review shared presets, especially ones from outside your organisation, for hostRules entries with headers.
- Pin external presets to a specific version or commit so contents cannot change under you.
- Keep secrets used in header templates scoped to the hosts that need them.
Why it matters
Allow lists only help if every route into the feature goes through them. Here the restriction was enforced for repository configuration but not for presets loaded from elsewhere. A configuration source that skips the check is an alternate path.
Dependency update bots hold credentials for registries and source hosts, so a way to attach headers to requests for other hosts is a way to move those credentials. Treat preset sources as code you run, and review them with the same care. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
Which versions fix CVE-2026-110865?
Renovate 44.60.1 for the npm package and community image, and 15.5.0 for Mend Renovate CE and EE, according to the GitHub advisory. The enterprise Helm chart is fixed in 10.5.0.
Who is affected?
Self-hosted administrators who restrict headers with allowedHeaders, and who allow shared presets, per the advisory.
Sources
Last reviewed: 18 October 2026.
