What is GHSA-h7j4-4vjp-jmxf?

GHSA-h7j4-4vjp-jmxf is a security advisory published by GitHub Security Advisories with High severity. Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to...

Which CVE IDs does GHSA-h7j4-4vjp-jmxf cover?

GHSA-h7j4-4vjp-jmxf covers the following CVE IDs: CVE-2026-110868. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h7j4-4vjp-jmxf?

GHSA-h7j4-4vjp-jmxf has a CVSS v3 base score of 8.5, published by GitHub Security Advisories.

GHSA-h7j4-4vjp-jmxfHighCVSS 8.5

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to...

Vendor

GitHub Security Advisories

Published

October 15, 2026

Last Modified

October 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-110868 →

📋 Description

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs.

🔗 References (4)

https://github.com/renovatebot/renovate/security/advisories/GHSA-8rqp-w6vc-pf27
https://nvd.nist.gov/vuln/detail/CVE-2026-110868
https://www.vulncheck.com/advisories/renovate-before-44.79.0-ssrf-via-http-preset-urls-and-customdatasources
https://github.com/advisories/GHSA-h7j4-4vjp-jmxf