CVE-2026-110868
HIGH
NVD
CVSS Score
8.5
Severity
HIGH
Published
Oct 14, 2026
Vendor
unknown
Description
Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.