CVE-2026-110867
Description
A flaw was found in Renovate. An attacker controlling an externally referenced configuration preset can bypass the environment variable allowlist. By defining restricted environment variables within a shared preset, the attacker can override critical execution settings such as PATH or LD_PRELOAD in child processes, potentially leading to arbitrary code execution on self-hosted systems.
Statement
Critical severity is assigned to this flaw because an attacker can achieve arbitrary remote code execution on the host runner by escaping process environment restrictions. In environments evaluating untrusted shared configurations, malicious presets can inject prohibited runtime variables during sub-process spawning. Red Hat products and pipeline components incorporating this technology either do not ship the vulnerable code or do not permit untrusted shared configuration presets in default deployments.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
