PT-2026-114179 · Mend+2 · Mend-Renovate-Ce Helm Chart+5
CVSS v3.1
7.1
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Renovate versions prior to 44.60.1
Description
An allowlist bypass exists that enables repository users to circumvent the
allowedHeaders restriction. This occurs when hostRules headers are placed within shared presets. An attacker can provide internal or external presets containing unvalidated hostRules[].headers to inject custom HTTP headers into requests sent by Renovate to other hosts.Recommendations
Update to version 44.60.1 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mend-Renovate-Ce Helm Chart
Mend-Renovate-Enterprise-Edition Helm Chart
Renovate
Renovate-Ce
Renovate-Ee-Server
Renovate-Ee-Worker