EUVD-2026-101749

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...

CVE-2026-110866

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...

CVE-2026-110866 Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...

CVE-2026-110866 Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...

CVE-2026-110866

Versions of Renovate prior to 44.61.3 are vulnerable to a protection mechanism bypass (CWE-693). The flaw allows an attacker to skip minimumReleaseAge checks when a user requests a PR rebase using the rebase/retry checkbox. This enables an attacker who publishes a malicious dependency to have tha...

CVE-2026-110866: Protection Mechanism Failure

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before...

PT-2026-114180

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.61.3 Description A protection mechanism bypass exists that allows minimumReleaseAge checks to be skipped when a user requests a Pull Request PR rebase using the rebase/retry checkbox. This allows an attacker to...

CVE-2026-88884

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2026-88884

A flaw was found in Renovate, a dependency update automation tool. This vulnerability allows for the bypass of the minimumReleaseAge security control when processing digest updates. A remote attacker could exploit this by publishing a malicious dependency version, which Renovate would then...

CVE-2026-88884 Renovate before 44.3.1 Authentication Bypass via Digest Updates

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2026-88884

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal "minimumReleaseAge" stabili...

Reliance on Untrusted Inputs in a Security Decision

Overview renovate is a dependency updater. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision in the minimumReleaseAge process. An attacker can trigger automated pull requests and CI workflow execution for newly published or malicious dependenc...

CVE-2026-88884

Renovate , a dependency update automation tool, is affected by a stability-age bypass in versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0). The root cause is that digest updat...

PT-2026-89395

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...

CVE-2026-88884: Incorrect Authorization

Renovate is a dependency update automation tool. In versions before 44.3.1 and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0, digest updates are not subject to the internal minimumReleaseAge stability...