Renovate before 44.11.3 does not validate the Link header it receives when following pagination requests to a GitLab server. This omission allows an attacker who controls a compromised GitLab instance to craft a Link header that redirects Renovate to an attacker‑controlled endpoint. When Renovate follows that redirect, credentials used in the request are sent to the attacker, enabling credential exfiltration and potential account takeover. The weakness is a broken redirect validation flaw (CWE‑601).

The flaw impacts installations of Renovatebot’s Renovate software that are running any version earlier than 44.11.3. The issue surfaces only when Renovate communicates with a GitLab server that can supply malicious pagination responses; thus environments using Renovate in conjunction with GitLab are at risk.

The vulnerability carries a CVSS score of 9.2, indicating critical severity. EPSS data is not available, so the current exploitation probability is unknown, and it is not listed in CISA’s KEV catalog. Exploitation requires an attacker who can control the target GitLab server to supply a forged Link header during pagination. Once the header is delivered, Renovate automatically follows the redirect and sends authentication credentials to the attacker’s host, making this a straightforward attack once the initial compromise exists.