{"id":"CVE-2026-110868","summary":"Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources","details":"Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.","aliases":["GHSA-8rqp-w6vc-pf27"],"modified":"2026-10-15T10:47:31.832240202Z","published":"2026-10-14T22:52:56.896Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-918"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110868.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/110xxx/CVE-2026-110868.json"},{"type":"ADVISORY","url":"https://github.com/renovatebot/renovate/security/advisories/GHSA-8rqp-w6vc-pf27"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110868"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/renovate-before-44.79.0-ssrf-via-http-preset-urls-and-customdatasources"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/renovatebot/renovate","events":[{"introduced":"0"},{"fixed":"238e15a4987ea922437fe8a04d70d2755532536c"},{"fixed":"107051e7cda5dce09f9f3f5f2895e55d94e936f7"},{"fixed":"4cebc7ad6411a84bedba48e4df657aecc05ee354"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"0"},{"fixed":"44.79.0"},{"fixed":"15.6.0"},{"fixed":"10.6.0"}]}}],"versions":["v10.5.5","v10.5.4","v10.5.3","v10.5.2","v10.5.1","v10.5.0","v10.4.8","v10.4.7","v10.4.6","v10.4.5","v10.4.4","v10.4.3","v10.4.2","v10.4.0","v10.3.5","v10.3.4","v10.3.3","v10.3.2","v10.3.1","v10.3.0","v10.2.0","v10.1.8","v10.1.7","v10.1.6","v10.1.5","v10.1.4","v10.1.3","v10.1.2","v10.1.1","v10.1.0","v10.0.6","v10.0.5","v10.0.4","v10.0.3","v10.0.2","v10.0.1","v10.0.0","v9.98.5","v9.98.4","v9.98.3","v9.98.2","v9.98.1","v9.98.0","v9.97.12","v9.97.11","v9.97.10","v9.97.9","v9.97.8","v9.97.7","v9.97.6","v9.97.5","v9.97.4","v9.97.3","v9.97.2","v9.97.1","v9.97.0","v9.96.4","v9.96.3","v9.96.2","v9.96.1","v9.96.0","v9.95.7","v9.95.6","v9.95.5","v9.95.4","v9.95.3","v9.95.2","v9.95.1","v9.95.0","v9.94.1","v9.94.0","v9.93.3","v9.93.2","v9.93.1","v9.93.0","v9.92.2","v9.92.1","v9.92.0","v9.91.1","v9.91.0","v9.90.4","v9.90.3","v9.90.2","v9.90.1","v9.90.0","v9.89.0","v9.88.2","v9.88.1","v9.88.0","v9.87.4","v9.87.3","v9.87.2","v9.87.1","v9.87.0","v9.86.0","v9.85.7","v9.85.6","v9.85.5","v9.85.4","v9.85.3","v9.85.2","v9.85.1","v9.85.0","v9.84.0","v9.83.0","v9.82.4","v9.82.3","v9.82.2","v9.82.1","v9.82.0","v9.81.0","v9.80.1","v9.80.0","v9.79.1","v9.79.0","v9.78.0","v9.77.0","v9.76.0","v9.75.2","v9.75.1","v9.75.0","v9.74.0","v9.73.6","v9.73.5","v9.73.4","v9.73.3","v9.73.2","v9.73.1","v9.73.0","v9.72.7","v9.72.6","v9.72.5","v9.72.4","v9.72.3","v9.72.2","v9.72.1","v9.72.0","v9.71.2","v9.71.1","v9.71.0","v9.70.1","v9.70.0","v9.69.5","v9.69.4","v9.69.3","v9.69.2","v9.69.1","v9.69.0","v9.68.5","v9.68.4","v9.68.3","v9.68.2","v9.68.1","v9.68.0","v9.67.2","v9.67.1","v9.67.0","v9.66.2","v9.66.1","v9.66.0","v9.65.8","v9.65.7","v9.65.6","v9.65.5","v9.65.4","v9.65.3","v9.65.2","v9.65.1","v9.65.0","v9.64.2","v9.64.1","v9.64.0","v9.63.0","v9.62.5","v9.62.4","v9.62.3","v9.62.2","v9.62.1","v9.62.0","v9.61.14","v9.61.13","v9.61.12","v9.61.11","v9.61.10","v9.61.9","v9.61.8","v9.61.7","v9.61.6","v9.61.5","v9.61.4","v9.61.3","v9.61.2","v9.61.1","v9.61.0","v9.60.2","v9.60.1","v9.60.0","v9.59.0","v9.58.3","v9.58.2","v9.58.1","v9.58.0","v9.57.0","v9.56.3","v9.56.2","v9.56.1","v9.56.0","v9.55.0","v9.54.2","v9.54.1","v9.54.0","v9.53.4","v9.53.3","v9.53.2","v9.53.1","v9.53.0","v9.52.3","v9.52.2","v9.52.1","v9.52.0","v9.51.0","v9.50.0","v9.49.2","v9.49.1","v9.49.0","v9.48.0","v9.47.1","v9.47.0","v9.46.1","v9.46.0","v9.45.12","v9.45.11","v9.45.10","v9.45.9","v9.45.8","v9.45.7","v9.45.6","v9.45.5","v9.45.4","v9.45.3","v9.45.2","v9.45.1","v9.45.0","v9.44.1","v9.44.0","v9.43.12","v9.43.11","v9.43.10","v9.43.9","v9.43.8","v9.43.7","v9.43.6","v9.43.5","v9.43.4","v9.43.3","v9.43.2","v9.43.1","v9.43.0","v9.42.9","v9.42.8","v9.42.7","v9.42.6","v9.42.5","v9.42.4","v9.42.3","v9.42.2","v9.42.1","v9.42.0","v9.41.0","v9.40.2","v9.40.1","v9.40.0","v9.39.0","v9.38.3","v9.38.2","v9.38.1","v9.38.0","v9.37.3","v9.37.2","v9.37.1","v9.37.0","v9.36.0","v9.35.10","v9.35.9","v9.35.8","v9.35.7","v9.35.6","v9.35.5","v9.35.4","v9.35.3","v9.35.2","v9.35.1","v9.35.0","v9.34.0","v9.33.0","v9.32.6","v9.32.5","v9.32.4","v9.32.3","v9.32.2","v9.32.1","v9.32.0","v9.31.4","v9.31.3","v9.31.2","v9.31.1","v9.31.0","v9.30.3","v9.30.2","v9.30.1","v9.30.0","v9.29.7","v9.29.6","v9.29.5","v9.29.4","v9.29.3","v9.29.2","v9.29.1","v9.29.0","v9.28.3","v9.28.2","v9.28.1","v9.28.0","v9.27.0","v9.26.2","v9.26.1","v9.26.0","v9.25.4","v9.25.3","v9.25.2","v9.25.1","v9.25.0","v9.24.2","v9.24.1","v9.24.0","v9.23.6","v9.23.5","v9.23.4","v9.23.3","v9.23.2","v9.23.1","v9.23.0","v9.22.3","v9.22.2","v9.22.1","v9.22.0","v9.21.0","v9.20.3","v9.20.2","v9.20.1","v9.20.0","v9.19.4","v9.19.3","v9.19.2","v9.19.1","v9.19.0","v9.18.0","v9.17.2","v9.17.1","v9.17.0","v9.16.1","v9.16.0","v9.15.0","v9.14.1","v9.14.0","v9.13.1","v9.13.0","v9.12.1","v9.12.0","v9.11.0","v9.10.3","v9.10.2","v9.10.1","v9.10.0","v9.9.0","v9.8.0","v9.7.3","v9.7.2","v9.7.1","v9.7.0","v9.6.2","v9.6.1","v9.6.0","v9.5.0","v9.4.0","v9.3.0","v9.2.2","v9.2.1","v9.2.0","v9.1.0","v9.0.13","v9.0.12","v9.0.11","v9.0.10","v9.0.9","v9.0.8","v9.0.7","v9.0.5","v9.0.4","v9.0.3","v9.0.2","v9.0.1","v9.0.0","v8.51.6","v8.51.5","v8.51.2","v8.51.1","v8.51.0","v8.50.1","v8.50.0","v8.49.5","v8.49.4","v8.49.3","v8.49.2","v8.49.1","v8.49.0","v8.48.5","v8.48.4","v8.48.3","v8.48.2","v8.48.1","v8.48.0","v8.47.0","v8.46.1","v8.46.0","v8.45.3","v8.45.2","v8.45.1","v8.45.0","v8.44.1","v8.44.0","v8.43.0","v8.42.3","v8.42.2","v8.42.1","v8.42.0","v8.41.0","v8.40.2","v8.40.1","v8.40.0","v8.39.1","v8.39.0","v8.38.1","v8.38.0","v8.37.1","v8.37.0","v8.36.1","v8.36.0","v8.35.2","v8.35.1","v8.35.0","v8.34.6","v8.34.5","v8.34.4","v8.34.3","v8.34.2","v8.34.1","v8.34.0","v8.33.0","v8.32.3","v8.32.2","v8.32.1","v8.32.0","v8.31.0","v8.30.4","v8.30.3","v8.30.2","v8.30.1","v8.30.0","v8.29.0","v8.28.4","v8.28.3","v8.28.2","v8.28.1","v8.28.0","v8.27.0","v8.26.0","v8.25.0","v8.24.0","v8.23.0","v8.22.0","v8.21.11","v8.21.10","v8.21.9","v8.21.8","v8.21.7","v8.21.6","v8.21.5","v8.21.4","v8.21.3","v8.21.2","v8.21.1","v8.21.0","v8.20.0","v8.19.2","v8.19.1","v8.19.0","v8.18.1","v8.18.0","v8.17.0","v8.16.0","v8.15.0","v8.14.1","v8.14.0","v8.13.0","v8.12.0","v8.11.2","v8.11.1","v8.11.0","v8.10.0","v8.9.3","v8.9.2","v8.9.1","v8.9.0","v8.8.4","v8.8.3","v8.8.2","v8.8.1","v8.8.0","v8.7.4","v8.7.3","v8.7.2","v8.7.1","v8.7.0","v8.6.4","v8.6.3","v8.6.2","v8.6.1","v8.6.0","v8.5.1","v8.5.0","v8.4.3","v8.4.2","v8.4.1","v8.4.0","v8.3.0","v8.2.7","v8.2.6","v8.2.5","v8.2.4","v8.2.3","v8.2.2","v8.2.1","v8.2.0","v8.1.0","v8.0.0","v7.6.0","v7.5.1","v7.5.0","v7.4.0","v7.3.1","v7.3.0","v7.2.0","v7.1.6","v7.1.5","v7.1.1","v7.1.0","v7.0.0","v6.3.1","v6.3.0","v6.2.0","v6.1.0","v6.0.2","v6.0.1","v6.0.0","v5.1.2","v5.1.1","v5.1.0","v5.0.2","v5.0.1","v5.0.0","v4.0.0","v3.1.0","v3.0.1","v3.0.0","v2.4.5","v2.4.4","v2.4.3","v2.4.2","v2.4.1","v2.4.0","v2.3.0","v2.2.0","v2.1.0","v2.0.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.1","v1.11.0","v1.10.0","v1.9.0","v1.8.0","v1.7.1","v1.7.0","v1.6.0","v1.5.0","v1.1.2","v1.1.1","v1.1.0","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-110868.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N"}]}