CVE-2026-88881
Undergoing Analysis Undergoing Analysis - In Progress

Information Disclosure in Renovate Dependency Tool

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromised GitHub server can return a `Link` header pointing to an attacker-controlled host and cause Renovate to disclose those credentials to it. Exploitation requires that the GitHub server Renovate talks to (as the repository host or as a datasource such as github-releases, github-tags, or git-refs) is already malicious or compromised. The issue is fixed in renovate 44.11.3 (npm and renovate/renovate container images), Mend Renovate CE/EE images and the mend-renovate-ce helm chart 15.4.0, and the mend-renovate-enterprise-edition helm chart 10.4.0. There is no workaround; the pre-existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check and should only be used with servers that intentionally use different pagination hosts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88881
EUVD
EUVD-2026-75431

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
renovatebot renovate 44.11.3
renovatebot renovate to 44.11.3 (exc)
mend renovate_ce to 15.4.0 (exc)
mend renovate_enterprise_edition to 10.4.0 (exc)
mend renovate 44.11.3
mend renovate_ce 15.4.0
mend renovate_enterprise_edition 10.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Renovate, a dependency update tool, follows pagination links in HTTP `Link` headers from GitHub servers. A malicious or compromised GitHub server can send a crafted `Link` header pointing to an attacker-controlled host, causing Renovate to send configured credentials to that host. This happens because the pagination URL is not validated against the original host.

Detection Guidance

Monitor network traffic for Renovate processes contacting unexpected external hosts during GitHub interactions. Check logs for HTTP requests to non-GitHub domains following pagination. Use tools like Wireshark or tcpdump to inspect traffic from Renovate containers or processes.

Impact Analysis

This vulnerability allows an attacker to steal credentials configured for GitHub interactions if the GitHub server is compromised. It can lead to unauthorized access to repositories, sensitive data exposure, or further attacks using the stolen credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade Renovate to version 44.11.3 or later. For CE/EE versions, update to 15.4.0 or 10.4.0 respectively. Avoid using the RENOVATE_X_REBASE_PAGINATION_LINKS option unless absolutely necessary and with trusted servers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88881. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart