CVE-2026-110868: Mend Mend-Renovate-CE Helm Chart

High severity, CVSS 8.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.

Affected products

• Mend Mend-Renovate-CE Helm Chart: before 15.6.0 (fixed in 15.6.0)
• Mend Mend-Renovate-Enterprise-Edition Helm Chart: before 10.6.0 (fixed in 10.6.0)
• Mend Renovate-CE: before 15.6.0 (fixed in 15.6.0)
• Mend Renovate-EE-Server: before 15.6.0 (fixed in 15.6.0)
• Mend Renovate-EE-Worker: before 15.6.0 (fixed in 15.6.0)
• Renovatebot Renovate: before 44.79.0 (fixed in 44.79.0)

Published 2026-10-14. Last modified 2026-10-16.