Renovate SSRF Flaw Exposes Internal Metadata in Versions Before 44.79.0

Renovate versions earlier than 44.79.0 contain a server-side request forgery vulnerability that permits unauthorized access to internal network resources. The flaw also impacts Mend’s self-hosted editions, including Community and Enterprise versions prior to 15.6.0.

What happened

The National Vulnerability Database records CVE-2026-110868 as a high-severity issue with a CVSS score of 8.4. The vulnerability stems from CWE-918 weaknesses in how the software handles HTTP requests. Specifically, the shared HTTP client within Renovate can be manipulated to request arbitrary internal URLs. This manipulation occurs through the use of extends presets or custom data sources.

According to the advisory, attackers can direct a preset toward an instance metadata service endpoint. This action allows them to obtain AWS credentials associated with the host. Alternatively, sensitive information may be leaked through the Renovate logs. The issue affects the open-source Renovate project before version 44.79.0. It also impacts Mend Renovate CE before 15.6.0. Mend Renovate EE Server and EE Worker versions before 15.6.0 are similarly affected. Helm charts for Mend Renovate CE before 15.6.0 and Mend Renovate Enterprise Edition before 10.6.0 are included in the scope.

Why it matters

This vulnerability grants attackers the ability to probe internal infrastructure from within the application. By forcing the server to make requests to internal URLs, they can bypass standard network perimeter defenses. Access to instance metadata services is particularly dangerous for cloud-hosted environments. It can lead to the theft of active AWS credentials. Once credentials are compromised, attackers may escalate their access to other cloud resources. The exposure of sensitive data through logs further increases the risk of information leakage.

What to watch

• Monitor for unusual outbound HTTP requests originating from the Renovate service.
• Check Renovate logs for requests to internal IP ranges or metadata endpoints.
• Verify that no custom data sources point to internal network addresses.
• Ensure that extends presets are sourced only from trusted repositories.

Who needs to act first

Teams usually prioritize systems exposed to external networks or untrusted users. Check whether your Renovate instances accept input from public repositories. Update these high-exposure systems first to limit the attack surface. Test any updates in a staging environment before rolling them out broadly. Back up configuration files and logs prior to making changes. If an immediate update is not possible, restrict network access from the Renovate server to internal metadata endpoints. Isolate the service from sensitive internal resources until a

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe

• Virtual patching blocks traffic signatures, not the vulnerable code itself.
• Internal attackers bypass network-edge protections entirely.
• Logic flaws like broken access control often evade signature-based detection.

Virtual patching buys time, it does not fix code. Apply the real patch as soon as possible to remove the underlying risk.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.