CVE-2026-88882
Undergoing Analysis Undergoing Analysis - In Progress

NuGet Registry Credential Exposure via Pagination

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0), when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by the registry in the HTTP `Link` header without verifying that the target has the same origin as the configured registry. Registry credentials are attached to the request for the 'next' page, so a malicious or compromised NuGet registry can return a `Link` header pointing at an attacker-controlled server and cause Renovate to send the registry credentials to that server. Exploitation requires the remote registry to be malicious or compromised; such a registry would normally already have received the credentials on the initial request, so the issue primarily allows the credentials to be delivered to an additional, attacker-chosen host. The fix restricts pagination to the same origin; the previous behaviour can be re-enabled with the RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN option.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88882
EUVD
EUVD-2026-75432

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
renovatebot renovate to 44.11.2 (exc)
renovate renovate to 44.11.2 (exc)
mend renovate_ce to 15.4.0 (exc)
mend renovate_ee to 15.4.0 (exc)
mend renovate_enterprise_edition to 10.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88882 is a vulnerability in Renovate, a dependency update automation tool. When Renovate checks a NuGet registry for package updates, it follows pagination links in the HTTP Link header to fetch more results. Normally, these links should point back to the same registry, but Renovate versions before 44.11.2 do not verify the origin of these links. A malicious or compromised NuGet registry can send a Link header pointing to an attacker-controlled server, causing Renovate to send registry credentials to that server. This allows credential exfiltration to an additional host beyond the initial registry.

Detection Guidance

To detect this vulnerability, monitor network traffic for Renovate processes making HTTP requests to NuGet registries. Check for outbound connections to unexpected domains following initial registry requests. Review HTTP Link headers in responses from NuGet registries for cross-origin URLs. Inspect Renovate logs for pagination requests to non-registry domains.

Impact Analysis

If you use Renovate with a NuGet registry, an attacker who compromises or controls the registry could steal your registry credentials. This could lead to unauthorized access to your package repositories or other systems using those credentials. The impact is limited to environments where the NuGet registry is already compromised, as the attacker would need to control or manipulate the registry to exploit this issue.

Compliance Impact

This vulnerability primarily involves the unauthorized exfiltration of registry credentials to an attacker-controlled server. While it does not directly impact GDPR or HIPAA compliance, it could indirectly affect compliance by exposing sensitive data (credentials) that may be used to access systems handling personal or health information. Unauthorized credential exposure could lead to breaches of confidentiality, integrity, or availability requirements under these regulations.

Mitigation Strategies

Upgrade Renovate to version 44.11.2 or later. For Mend Renovate CE/EE, update to version 15.4.0 or later. For the enterprise edition helm chart, upgrade to version 10.4.0 or later. Avoid using the RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN workaround unless absolutely necessary with trusted registries.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88882. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart