CVE-2026-110867
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placi
CVSS
8.5
Alta
EPSS
0.3%
p20
KEV
—
Exploit Today
6
0-100
Publicado: 14 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-863
0.2%EPSS · 30 dias0.3%
2026-10-152026-11-06
Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.
- github.comhttps://github.com/renovatebot/renovate/security/advisories/GHSA-6873-xr44-22vm
- www.vulncheck.comhttps://www.vulncheck.com/advisories/renovate-before-44.60.1-allowedenv-allowlist-bypass-via-shared-preset
- github.comhttps://github.com/nodemailer/nodemailer/security/advisories/GHSA-4g23-2xm8-66gc
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-186894.3 MÉD—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an authenticated user to obtain limited information about other organizations due to incorrect authorization. A token issued for a limited purpose is accepted where it should not be, which could reveal the names of other organizations.5hCVE-2026-173787.7 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.5hCVE-2026-173737.7 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.5hCVE-2026-173438.1 ALT—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization.5hCVE-2026-167115.3 MÉD—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to inject platform credentials into outbound requests due to improper input validation. A validation check is not sufficiently strict, which could cause platform credentials to be included in outbound requests.5hCVE-2026-1232189.8 CRÍ—
———IBM Aspera Faspex 5.0.0 through 5.0.19 could allow an authorized user to craft a specific message to bypass user authorization and gain full administrative privileges.6h