Renovate Users Urged to Update After Critical Env Variable Bypass CVE-2026-110867

Self-hosted Renovate instances running versions prior to 44.60.1 face a critical security risk due to an allowlist bypass vulnerability. The flaw permits repositories to set restricted environment variables through shared presets, potentially allowing attackers to override system settings.

What happened

The National Vulnerability Database recorded CVE-2026-110867 as a critical issue with a CVSS score of 9. This weakness, categorized under CWE-863, exists in Renovate versions earlier than 44.60.1. It allows repositories to circumvent environment variable restrictions by placing environment configurations inside a shared preset.

Attackers who control an externally sourced preset can exploit this bypass. They can override critical variables such as PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes. This capability is particularly dangerous on self-hosted instances where such variables influence system behavior and security boundaries.

Why it matters

This vulnerability affects a wide range of Renovate deployments. In addition to the core Renovate product before 44.60.1, Mend Renovate-CE versions before 15.5.0 are vulnerable. Mend Renovate-EE-server and Mend Renovate-EE-worker versions before 15.5.0 are also affected.

Helm chart users must also act. The Mend Renovate-CE Helm chart before version 15.5.0 and the Mend Renovate-Enterprise-Edition Helm chart before version 10.5.0 contain this flaw. Organizations relying on these tools for dependency management need to verify their current versions immediately.

What to watch

• Check if your Renovate instance is self-hosted and running an affected version.
• Review shared presets for any unauthorized environment variable configurations.
• Monitor logs for unexpected changes to PATH, LD_PRELOAD, or NODE_OPTIONS.
• Verify that no external presets are overriding security-critical system variables.

Who needs to act first

Teams should prioritize updating exposed, internet-facing self-hosted Renovate instances immediately. Begin by identifying all systems running vulnerable versions of Renovate, Renovate-CE, or Renovate-EE. Apply updates in a maintenance window to minimize disruption. If testing is required, isolate the update process from production workloads. Backup configuration files before applying changes. Monitor system behavior closely after the update to ensure no residual environment variable overrides persist.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: Renovate

• Audit all Renovate installations to confirm they are at or above the safe version thresholds.
• Inspect shared presets for any embedded environment variable definitions that could be malicious.
• Restrict access to externally sourced presets to prevent unauthorized configuration changes.
• Monitor process execution logs for unexpected variable overrides in child processes.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Renovate are affected by CVE-2026-110867?

Renovate versions before 44.60.1, Mend Renovate-CE before 15.5.0, and Mend Renovate-EE products before 15.5.0 are vulnerable.

What can attackers do with this vulnerability?

Attackers can bypass allowlists to set restricted environment variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO via shared presets.

Is there a fix available for this critical vulnerability?

Yes, updating to Renovate version 44.60.1 or later, and corresponding Mend product versions, resolves the issue.