The vulnerability allows an actor with read access to Renovate logs to retrieve TLS private keys that are used for mutual authentication. The implementation flaw results in incomplete redaction of the hostRules[].httpsPrivateKey value when it is referenced elsewhere in configuration or log messages, leaving the full key in plaintext. The exposed key could be used to impersonate the service, gain unauthorized access, or compromise future connections. This flaw is a classic example of log injection and improper sanitisation, corresponding to CWE-532.

The affected product is Renovate, the automated dependency update tool produced by renovatebot. Versions earlier than 44.14.4 are impacted, as are Mend‑Renovate CE/EE Docker images below version 15.4.0 and the mend-renovate‑enterprise‑edition Helm chart prior to 10.4.0. Any deployment that configures the httpsPrivateKey in hostRules[].httpsPrivateKey without delivering it through the documented secrets configuration is vulnerable.

The CVSS score of 8.3 indicates a high impact and moderate to high likelihood of exploitation. Although the EPSS score is not available, the vulnerability is not listed in CISA’s KEV catalogue, suggesting that no widespread exploit is currently confirmed. The most likely attack vector requires local or remote log reading; an attacker who can access the log files can extract the private key and use it to forge TLS connections. Protection of log access and applying the patch are essential to mitigate risk.