CVE-2020-37267
Received Received - Intake

Token Exposure in Renovate Azure DevOps Integration

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2020-37267
EUVD
EUVD-2020-31261

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
renovatebot renovate From 19.180.0 (inc) to 23.25.1 (exc)
renovatebot renovate 23.25.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Renovate bot versions between 19.180.0 and 23.25.0 when used with Azure DevOps. It causes the bot's authorization token to be exposed in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to these logs could obtain the bot's credentials.

Detection Guidance

Check Renovate logs for exposed authorization tokens in server or pipeline logs. Look for entries containing http.extraheader=AUTHORIZATION or raw token values. Search logs for strings like 'Authorization: Bearer' or similar patterns.

Impact Analysis

If you use Renovate with Azure DevOps and are running a vulnerable version, your bot's authorization token could be exposed in logs. This could allow unauthorized individuals with log access to obtain the bot's credentials, potentially leading to unauthorized actions or data access.

Compliance Impact

This vulnerability exposes authorization tokens in logs, which could lead to unauthorized access to sensitive systems. For GDPR, this may violate Article 32 (security of processing) if personal data is exposed. For HIPAA, it could risk protected health information if credentials grant access to healthcare systems.

Mitigation Strategies

Upgrade Renovate to version 23.25.1 or later. Revoke and regenerate all Azure DevOps bot credentials. Review and redact any logs that may have exposed tokens before sharing or storing them.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2020-37267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart