CVE-2026-88883
Undergoing Analysis Undergoing Analysis - In Progress

Incomplete Log Sanitization in Renovate Exposes TLS Private Keys

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0), log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of hostRules[].httpsPrivateKey was redacted in the field itself, the same private key value was not redacted if it also appeared elsewhere — for example in another configuration option or in a log message under a key other than httpsPrivateKey — causing the full private key to be written to Renovate's logs in cleartext. This affects deployments that configure Mutual TLS through hostRules[].httpsPrivateKey without passing the value through the documented `secrets` configuration. Anyone able to read the resulting logs can recover the private key. The issue is fixed in Renovate 44.14.4, which redacts any value supplied as hostRules[].httpsPrivateKey wherever it appears in the logs; as a workaround, supply the key via the `secrets` configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88883
EUVD
EUVD-2026-75433

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
mend renovate_enterprise_edition_helm_chart to 10.4.0 (exc)
renovate renovate to 44.14.4 (exc)
mend renovate_ce to 15.4.0 (exc)
mend renovate_ee to 15.4.0 (exc)
mend renovate_enterprise_edition to 10.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Renovate, an automated dependency update tool. In versions before 44.14.4, private keys used for Mutual TLS were not fully redacted in logs. If a private key was configured via hostRules[].httpsPrivateKey, it could appear in cleartext in logs under other keys or configuration options. This exposed the private key to anyone with log access.

Detection Guidance

To detect this vulnerability, check Renovate logs for any instances where TLS private keys appear in cleartext outside the httpsPrivateKey field. Search logs for patterns matching private key formats (e.g., 'BEGIN PRIVATE KEY' or 'BEGIN RSA PRIVATE KEY'). If keys are found in logs, the system is vulnerable.

Impact Analysis

If you use Renovate versions before 44.14.4 with Mutual TLS configured via hostRules[].httpsPrivateKey, your TLS private key could be exposed in logs. Anyone with access to these logs can recover the private key, potentially allowing unauthorized access to systems or data protected by that TLS certificate.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A private key leak may violate these regulations, potentially resulting in legal penalties or data breach notifications.

Mitigation Strategies

Upgrade Renovate to version 44.14.4 or later. Alternatively, reconfigure Mutual TLS to use the secrets configuration instead of hostRules[].httpsPrivateKey. Review and redact any logs containing exposed private keys immediately.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88883. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart