CVE-2026-110866

EUVD-2026-101749
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.7 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.38%
Common Weakness Enumeration
References
https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h
https://www.vulncheck.com/advisories/renovate-before-44.61.3-minimumreleaseage-bypass-via-pr-rebase-request