PT-2026-114182 · Mend+2 · Mend-Renovate-Ce Helm Chart+5
CVSS v3.1
8.5
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Renovate versions prior to 44.79.0
Description
An issue exists where users can trigger server-side request forgery, a flaw that allows a server to be coerced into making requests to an unintended location. This occurs when the shared HTTP client requests arbitrary internal URLs through
extends presets or customDatasources. This could allow an attacker to target an instance metadata service endpoint to retrieve AWS credentials or leak sensitive data via logs.Recommendations
Update to version 44.79.0 or later.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mend-Renovate-Ce Helm Chart
Mend-Renovate-Enterprise-Edition Helm Chart
Renovate
Renovate-Ce
Renovate-Ee-Server
Renovate-Ee-Worker