CVE-2026-110866 — Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase Request
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/r…
Published: 2026-10-14 · CVSS: 5.3 · CVSS 4.0
Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7