Renovate before 44.60.1 contains an allowlist bypass that permits repository users to embed hostRules headers inside shared presets. By doing so, attackers can supply internal or externally sourced presets with unvalidated hostRules[].headers and inject arbitrary HTTP headers into requests that Renovate sends to other hosts. This can subvert the intended header restrictions and may facilitate request forgeries or other downstream exploitation.

The vulnerability applies to all editions of Renovate with shared presets handling including the Mend Renovate Community Edition, Mend Renovate Enterprise Edition, Mend Renovate EE Server and Worker, and the RenovateBot Renovate Helm charts. All product lines that use the shared preset feature prior to version 44.60.1 are affected, and no specific version information beyond the lower bound is provided.

The CVSS v3.1 score of 7.1 indicates a medium to high impact, and the EPSS score of 0.00185 (<1%) indicates a very low but not zero probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers with repository write access can add a malicious shared preset containing hostRules headers. By crafting such a preset, they can influence the HTTP requests Renovate makes to external services, potentially enabling header injection attacks. No additional prerequisites such as administrative privileges are required beyond the ability to supply or modify shared presets.