CVE-2026-110868
Description
A flaw was found in Renovate. A Server-Side Request Forgery (SSRF) vulnerability allows an attacker to coerce the shared HTTP client into sending requests to arbitrary internal network addresses through crafted presets or custom data sources. This issue primarily leads to sensitive information disclosure, enabling an attacker to query internal cloud instance metadata endpoints and expose sensitive credentials in application logs.
Statement
A moderate information-disclosure vulnerability via server-side request forgery (SSRF) was found in Renovate. In Red Hat's Konflux offering, Renovate is shipped as the MintMaker Renovate container image, which is affected by this flaw. A user with privileges to define Renovate configuration, such as an 'extends' preset URL or a customDatasources entry pointing to an attacker-controlled HTTP URL, can make Renovate's shared HTTP client send requests to arbitrary internal network addresses from within the Renovate deployment. This can be abused to query internal-only services such as a cloud instance metadata service (for example the AWS EC2 metadata endpoint), and to expose sensitive information such as cloud instance credentials or other internal data through Renovate logs. Red Hat rates this flaw moderate rather than the upstream high severity: under Red Hat's SSRF scoring guidance the forged requests originate and remain within the Renovate process's own security scope, and the demonstrated impact is limited to information disclosure. The Konflux MintMaker Renovate image is affected and a fix is being pursued.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Access Control
Technical Impact: Bypass Protection Mechanism
By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
