Renovate before version 44.79.0 is vulnerable to a server‑side request forgery that allows a user to configure HTTP preset URLs or customDatasources to point to arbitrary internal addresses. This flaw enables an attacker to force Renovate’s shared HTTP client to request internal endpoints, potentially leaking sensitive data or stealing credentials. The vulnerability is classified as CWE‑918 and, according to the CVSS score, is a high‑severity flaw that could compromise confidentiality and integrity of an entire deployment.

The affected products are Mend’s Renovate Community Edition (mend-renovate‑ce), Enterprise Edition helm charts (mend‑renovate‑ce and mend‑renovate‑enterprise‑edition), and the renovatebot:renovate packages for the server and worker components. All releases prior to 44.79.0 are impacted.

The CVSS score of 8.4 indicates high severity. EPSS information is not available, so the exact likelihood of exploitation is unknown; however, the vulnerability is listed as not part of the CISA KEV catalog. The description does not state any special prerequisites, but the attack requires the ability to inject or modify preset URLs or customDatasource configurations in a running Renovate instance. Based on that, the likely attack vector is through the configuration management interface, requiring either authenticated access to the instance or potentially unauthenticated access if the configuration can be altered externally. The flaw gives attackers an internal network view, enabling them to reach services such as the instance metadata service to obtain cloud credentials or read internal resources that should be isolated.