Renovate, a dependency automation tool, follows pagination URLs obtained from a HTTP Link header when querying container registries. The tool attaches stored registry credentials to any subsequent request without ensuring the next URL is on the same origin. An attacker who can control or compromise a registry can supply a Link header that redirects to an external host, causing Renovate to send its credentials to that host. This flaw allows an attacker to obtain registry credentials used by Renovate, exposing the secrets for container registry access. The vulnerability is categorized as an arbitrary credential disclosure and is identified as CWE‑601.

All installations of Renovate prior to version 44.11.2 are susceptible. The issue also applies to Mend Renovate Community Edition and Enterprise Edition versions 15.3.x and earlier, and to the mend-renovate-enterprise-edition Helm chart versions below 10.4.0. The affected packages include the npm and renovate/renovate Docker images used by the tool.

The CVSS score of 9.2 indicates a high impact vulnerability with a potentially wide reach. The EPSS score is not available, but the flaw requires only that a target has container dependencies and interacts with a malicious or compromised registry, a common scenario for projects using Renovate. The vulnerability is not currently listed in the CISA KEV catalog, but its severity warrants immediate attention. An attacker can exploit it by simply providing a malicious Link header via a compromised registry; no additional privileges or complex conditions are required.