PT-2026-114180 · Mend+2 · Mend-Renovate-Ce Helm Chart+5
CVSS v4.0
5.3
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
Name of the Vulnerable Software and Affected Versions
Renovate versions prior to 44.61.3
Description
A protection mechanism bypass exists that allows
minimumReleaseAge checks to be skipped when a user requests a Pull Request (PR) rebase using the rebase/retry checkbox. This allows an attacker to publish a malicious dependency version and have it pushed into the PR to execute within the Continuous Integration (CI) environment before the required release age has elapsed.Recommendations
Update to version 44.61.3 or later.
Exploit
Fix
Protection Mechanism Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mend-Renovate-Ce Helm Chart
Mend-Renovate-Enterprise-Edition Helm Chart
Renovate
Renovate-Ce
Renovate-Ee-Server
Renovate-Ee-Worker