CVE-2026-88881

Renovate before 44.11.3 Credential Exfiltration via Link Header

Published Sep 10, 2026 CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Description

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromised GitHub server can return a `Link` header pointing to an attacker-controlled host and cause Renovate to disclose those credentials to it. Exploitation requires that the GitHub server Renovate talks to (as the repository host or as a datasource such as github-releases, github-tags, or git-refs) is already malicious or compromised. The issue is fixed in renovate 44.11.3 (npm and renovate/renovate container images), Mend Renovate CE/EE images and the mend-renovate-ce helm chart 15.4.0, and the mend-renovate-enterprise-edition helm chart 10.4.0. There is no workaround; the pre-existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check and should only be used with servers that intentionally use different pagination hosts.

Analysis

Technical impact

The vulnerability is a flaw where the application follows pagination links supplied by the server in the HTTP Link header without validating the host, resulting in credentials being sent to an attacker‑controlled host. This leads to credential exfiltration. The weakness is CWE‑601.

Affected Systems

The issue affects Renovate versions prior to 44.11.3, including npm packages and container images, as well as Mend Renovate CE/EE images and the mend‑renovate‑ce helm chart 15.4.0 and the mend‑renovate‑enterprise‑edition helm chart 10.4.0. It applies when Renovate interacts with GitHub.com, GitHub Enterprise Cloud or GitHub Enterprise Server.

Risk and Exploitability

The CVSS score of 9.2 indicates a severe risk, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the GitHub server Renovate connects to is already malicious or has been compromised; the attacker must supply a Link header that points to an attacker‑controlled host. If such a compromised host is used, credentials configured for the host will be transmitted, exposing authentication tokens.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

renovatebot

renovate

unaffected

Version	Status	Constraints
`0`	affected	< 44.11.3
`44.11.3`	unaffected	—

mend

renovate-ce

unaffected

Version	Status	Constraints
`0`	affected	< 15.4.0
`15.4.0`	unaffected	—

mend

renovate-ee-server

unaffected

Version	Status	Constraints
`0`	affected	< 15.4.0
`15.4.0`	unaffected	—

mend

renovate-ee-worker

unaffected

Version	Status	Constraints
`0`	affected	< 15.4.0
`15.4.0`	unaffected	—

mend

mend-renovate-ce

unaffected

Version	Status	Constraints
`0`	affected	< 15.4.0
`15.4.0`	unaffected	—

mend

mend-renovate-enterprise-edition

unaffected

Version	Status	Constraints
`0`	affected	< 10.4.0
`10.4.0`	unaffected	—

No data.

Vendor Product Versions

Renovatebot

Renovate

Version	Status	Scheme	Platform
`[0,44.11.3)`	affected	semver	—
`44.11.3`	unaffected	semver	—

Renovatebot

Renovate

Version	Status	Scheme	Platform
`[0,15.4.0)`	affected	semver	—
`15.4.0`	unaffected	semver	—

Renovatebot

Renovate

Version	Status	Scheme	Platform
`[0,10.4.0)`	affected	semver	—
`10.4.0`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Renovate to version 44.11.3 or later, including npm and container images.
Upgrade Mend Renovate CE/EE images to 15.4.0 or the helm chart to 10.4.0.
Ensure that any GitHub servers accessed are secure and not compromised, and avoid using untrusted hosts.
Do not enable the RENOVATE_X_REBASE_PAGINATION_LINKS option.

Generated by OpenCVE AI on September 10, 2026 at 14:58 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.409% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/renovatebot/renovate/security/advisories/GHSA-w57v-h33h-835c
https://www.vulncheck.com/advisories/renovate-before-44.11.3-credential-exfiltration-via-link-header-2

History

Sep 15, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 11:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Renovatebot Renovatebot renovate
Vendors & Products		Renovatebot Renovatebot renovate

Sep 10, 2026 1:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromised GitHub server can return a `Link` header pointing to an attacker-controlled host and cause Renovate to disclose those credentials to it. Exploitation requires that the GitHub server Renovate talks to (as the repository host or as a datasource such as github-releases, github-tags, or git-refs) is already malicious or compromised. The issue is fixed in renovate 44.11.3 (npm and renovate/renovate container images), Mend Renovate CE/EE images and the mend-renovate-ce helm chart 15.4.0, and the mend-renovate-enterprise-edition helm chart 10.4.0. There is no workaround; the pre-existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check and should only be used with servers that intentionally use different pagination hosts.
Title		Renovate before 44.11.3 Credential Exfiltration via Link Header
Weaknesses		CWE-601
References		https://github.com/renovatebot/renovate/security/advisories/GHSA-w57v-h33h-835c https://www.vulncheck.com/advisories/renovate-before-44.11.3-credential-exfiltration-via-link-header-2
Metrics		cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N'}` cvssV4_0 `{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}`