CVE-2026-110866
Description
A flaw was found in Renovate. This protection mechanism bypass occurs when a user triggers a pull request rebase using the rebase or retry checkbox, causing minimum package release age checks to be skipped. Consequently, an attacker who publishes a malicious dependency version can have untrusted code incorporated into automated pull requests and executed in Continuous Integration (CI) pipelines before the designated waiting period elapses.
Statement
A MODERATE severity protection mechanism bypass was found in Renovate, which Red Hat ships in Konflux as part of the mintmaker-renovate-image container image used by the Mint Maker dependency-update service. When a user requests a rebase of a Renovate pull request using the rebase/retry checkbox, Renovate skips the configured minimumReleaseAge checks and updates the targeted dependency to its latest published version. Consequently, an attacker who publishes a malicious dependency version to a public package registry can have that untrusted version incorporated into an automated pull request and executed in Continuous Integration (CI) pipelines before the designated waiting period elapses. Exploitation requires user interaction, since a repository maintainer or collaborator must trigger the rebase, and the direct impact is limited to integrity, with no direct effect on confidentiality or availability. Red Hat rates this flaw as MODERATE, consistent with the upstream CVSS v3.1 score of 4.7. The fix for the Konflux mintmaker-renovate-image component is deferred because the impact is MODERATE with a CVSS score below 7.0; until a fixed image is shipped, the residual risk remains that a user-requested rebase can bypass the minimumReleaseAge protection and pull a dependency version newer than the configured release age into a pull request and CI environment.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Renovate upstream addressed this issue in version 44.61.3; updating to a Renovate release that includes this fix, such as a Konflux mintmaker-renovate-image build containing it, resolves the issue.
Understanding the Weakness (CWE)
Other
Technical Impact: Alter Execution Logic; Unexpected State
By performing actions in an unexpected order, or by omitting steps, an attacker could manipulate the business logic of the product or cause it to enter an invalid state. In some cases, this can also expose resultant weaknesses with security implications.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
