CVE-2026-110866

Description

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/renovatebot/renovate/security/advisories/GHSA-2frq-pm48-6j4h ↗
• https://www.vulncheck.com/advisories/renovate-before-44.61.3-minimumreleaseage-bypass-via-pr-rebase-request ↗