In certain failure scenarios when Renovate updates Go Modules, temporary repository tokens are inadvertently written to pull request comments. The exposure of these tokens compromises the confidentiality of repository access credentials, allowing any user who can view the affected comments to authenticate to the repository and potentially gain broader access. This vulnerability is categorized as CWE‑532, which describes the unintended disclosure of sensitive information.

The vulnerability affects Renovatebot Renovate versions starting with 13.87.0 and up to (but not including) 19.38.7. The issue is resolved in version 19.38.7 and later releases.

The CVSS score of 8.7 indicates high severity. EPSS score is 0.00314 (<1%), indicating a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker to trigger a failing Go Modules update and then view the pull request comments where the tokens are exposed; this can be done by anyone with read access to the repository's pull requests. The impact is the leakage of secure credentials, potentially leading to unauthorized repository access and manipulation.