A vulnerability exists in versions of Renovate prior to 44.11.2 (and corresponding Mend images and Helm charts) that causes the tool to follow the pagination URLs included in the HTTP `Link` header from a NuGet registry without validating that the target remains within the same origin. Consequently, if a registry—malicious or compromised—returns a `Link` header pointing to an attacker‑controlled server, Renovate will send the registry credentials that it attached to the original request to that server. The result is unintended credential exfiltration. This flaw falls under CWE‑601, which involves external redirects or link following. The vulnerability does not grant arbitrary code execution but can expose proprietary registry credentials, leading to unauthorized access to private packages and potential downstream supply‑chain compromise.

Product: Renovate (renovatebot:renovate), a dependency update automation tool. Vulnerable versions include all releases before 44.11.2. In addition, Mend Renovate Community and Enterprise images and Helm charts that bundle Renovate are affected if they are before 15.4.0 (images/charts) and 10.4.0 (helm chart). These components are used in CI/CD pipelines and container deployments that rely on private NuGet registries.

The CVSS score of 9.2 indicates a high‑severity problem. While the EPSS score is not available, the severity rating suggests a significant. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to control or compromise a NuGet registry so that it can supply a malicious `Link` header; the attacker can then receive the registry credentials on subsequent pagination requests. An attacker who has already obtained credentials by normal operation could redirect them to an additional, attacker‑chosen host, compounding the damage. The credential leakage through cross‑origin pagination links is a serious concern for environments that store sensitive registry secrets.