Renovate releases between 19.180.0 and 23.25.0 include a logging feature that records the git http.extraheader=AUTHORIZATION parameter without redaction when the bot interacts with Azure DevOps. This oversight exposes the bot's authorization token to anyone who can view the resulting server or pipeline logs, effectively revealing credentials that allow unrestricted access to Azure DevOps repositories and potentially other connected services. The weakness is a classic case of uncontrolled log or error data exposure (CWE‑532).

All deployments of the Renovate bot (renovatebot:renovate) from version 19.180.0 up to but not including 23.25.1 that are configured to use Azure DevOps for source control operations are affected. The leakage occurs during typical authentication steps when the bot pushes or pulls code. Users of earlier or later versions are not impacted.

The CVSS score of 8.7 classifies this flaw as high severity. The EPSS metric is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, so public exploitation data are limited. Given that log data must be accessible to the attacker, the exploit requires read access to Azure DevOps logs or pipeline output; an insider threat or compromised account with such permissions could retrieve the token. Once obtained, the token permits full API access to the bot's Azure DevOps account, enabling data theft, repository sabotage, or further lateral movement.