EUVD-2026-101751

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110868

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

CVE-2026-110868

Renovate versions before 44.79.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The issue allows users to force the shared HTTP client to request arbitrary internal URLs through extends presets or customDatasources . An attacker can exploit this by pointing a preset at an i...