CVE-2026-110867: Mend Mend-Renovate-CE Helm Chart

High severity, CVSS 8.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.

Affected products

• Mend Mend-Renovate-CE Helm Chart: before 15.5.0 (fixed in 15.5.0)
• Mend Mend-Renovate-Enterprise-Edition Helm Chart: before 10.5.0 (fixed in 10.5.0)
• Mend Renovate-CE: before 15.5.0 (fixed in 15.5.0)
• Mend Renovate-EE-Server: before 15.5.0 (fixed in 15.5.0)
• Mend Renovate-EE-Worker: before 15.5.0 (fixed in 15.5.0)
• Renovatebot Renovate: before 44.60.1 (fixed in 44.60.1)

Published 2026-10-14. Last modified 2026-10-16.