renovate-operator

Renovate: The Kubernetes-Native Way Run Renovate on your own infrastructure with CRD-based scheduling, parallel execution, auto-discovery, and a built-in UI. If you self-host Renovate and already run Kubernetes, this operator gives you the control and observability that plain self-hosted setups...

CLEANSTART-2026-ME02070 source-map-js through 1

Security vulnerability affects the renovate package. source-map-js through 1...

CLEANSTART-2026-CF50280 Security fix for GHSA-5p4m-2wfm-xmqj applied in: renovate 44.154.1-r1, renovate 44.152.0-r1

GHSA-5p4m-2wfm-xmqj affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JW65236 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

Security vulnerability affects the renovate package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

CLEANSTART-2026-JF11250 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

Security vulnerability affects the renovate package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

CLEANSTART-2026-GY49869 brace-expansion library generates arbitrary strings containing a common prefix and suffix

Security vulnerability affects the renovate package. The brace-expansion library generates arbitrary strings containing a common prefix and suffix...

CLEANSTART-2026-ZU44577 js-yaml is a JavaScript YAML parser and dumper

Security vulnerability affects the renovate package. js-yaml is a JavaScript YAML parser and dumper...

CLEANSTART-2026-AO11552 node-tar is a full-featured Tar for Node

Security vulnerability affects the renovate package. node-tar is a full-featured Tar for Node...

CLEANSTART-2026-FH34205 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

Security vulnerability affects the renovate package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

CLEANSTART-2026-ED95954 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

Security vulnerability affects the renovate package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...

CLEANSTART-2026-SS22483 Picomatch is a glob matcher written JavaScript

Security vulnerability affects the renovate package. Picomatch is a glob matcher written JavaScript...

EUVD-2026-101749

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...

EUVD-2026-101751

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

EUVD-2026-101748

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by placing hostRules headers inside shared presets. Attackers can supply internal or externally sourced presets with unvalidated hostRules.headers to inject cust...

EUVD-2026-101750

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LDPRELOAD, NODEOPTIONS, or GITSSLCAINFO i...

CVE-2026-110866

A flaw was found in Renovate. This protection mechanism bypass occurs when a user triggers a pull request rebase using the rebase or retry checkbox, causing minimum package release age checks to be skipped. Consequently, an attacker who publishes a malicious dependency version can have untrusted...

CVE-2026-110868

A flaw was found in Renovate. A Server-Side Request Forgery SSRF vulnerability allows an attacker to coerce the shared HTTP client into sending requests to arbitrary internal network addresses through crafted presets or custom data sources. This issue primarily leads to sensitive information...

CVE-2026-110865

A flaw was found in Renovate. This vulnerability allows an authenticated repository user to bypass HTTP Hypertext Transfer Protocol header restrictions by specifying custom headers within shared configuration presets. By injecting arbitrary headers into outbound requests sent by Renovate, an...

CVE-2026-110867

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LDPRELOAD, NODEOPTIONS, or GITSSLCAINFO i...

CVE-2026-110868

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...