VulnSocial

CVE-2026-110868

LOWCVSS 8.4 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-10-15: 210-15
Referenced assets1 URL
Full discourse2 posts
  • The Circuitry@thecircuitry_

    The Circuitry Daily Rundown: Oct 15 • Renovatebot Renovate hit by high-severity SSRF flaw CVE-2026-110868 • Sega Pulls Shogun 2 Remaster After AI Graphics Backlash • Markets slide on AI spending fears and hot CPI data Verified, in about a minute. https://t.co/2P7z1F1coM

    0000148
    42 followersView on X
  • Xavier Rivera@XavierRiveraX

    Renovate before 44.79.0 has a high-severity SSRF (CVE-2026-110868) that can aim presets at cloud metadata and pull AWS credentials. If you run Renovate or Mend Renovate CE/EE, patch now and treat the bot like a privileged CI identity. https://thecircuitry.to/article/renovatebot-renovate-hit-by-high-severity-ssrf-flaw-cve-2026-110868-mv9xztc0

    1000041
    601 followersView on X

Explore more

Back to dashboard