CVE-2026-110868

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.79.0

Description An issue exists where users can trigger server-side request forgery, a flaw that allows a server to be coerced into making requests to an unintended location. This occurs when the shared HTTP client requests arbitrary internal URLs through extends presets or customDatasources. This could allow an attacker to target an instance metadata service endpoint to retrieve AWS credentials or leak sensitive data via logs.

Recommendations Update to version 44.79.0 or later.