CVE-2026-110866: Mend Mend-Renovate-CE Helm Chart

Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.

Affected products

• Mend Mend-Renovate-CE Helm Chart: before 15.5.0 (fixed in 15.5.0)
• Mend Mend-Renovate-Enterprise-Edition Helm Chart: before 10.5.0 (fixed in 10.5.0)
• Mend Renovate-CE: before 15.5.0 (fixed in 15.5.0)
• Mend Renovate-EE-Server: before 15.5.0 (fixed in 15.5.0)
• Mend Renovate-EE-Worker: before 15.5.0 (fixed in 15.5.0)
• Renovatebot Renovate: before 44.61.3 (fixed in 44.61.3)

Published 2026-10-14. Last modified 2026-10-16.