Is CVE-2026-110866 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-110866?

CVE-2026-110866 has a CVSS v3 severity of MEDIUM (4.7).

Back

CVE-2026-110866

Description

Renovate before 44.61.3 contains a protection mechanism bypass vulnerability that allows minimumReleaseAge checks to be skipped when a user requests a PR rebase via the rebase/retry checkbox. Attackers who publish a malicious dependency version can have it pushed into the PR and run in CI before the required release age elapses.