CVE-2026-88884
Undergoing Analysis Undergoing Analysis - In Progress

Stored Digest Update Bypass in Renovate

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0), digest updates are not subject to the internal `minimumReleaseAge` (stability age) checks. When a repository configures `minimumReleaseAge` and has dependencies with `updateType=digest` — for example GitHub Actions pinned to a commit SHA with a floating tag, Docker images, Go modules or NuGet packages — Renovate will still open a pull request for a newly published digest, marked only with a pending `renovate/stability-days` status check. A newly published, potentially malicious dependency version can therefore cause a PR to be raised and CI workflows to potentially run before the configured minimum release age has elapsed, which is precisely what the Minimum Release Age control is intended to prevent. The issue is fixed in Renovate 44.3.1; as a workaround, digest updates can be disabled or gated behind `dependencyDashboardApproval`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88884
EUVD
EUVD-2026-75434

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
renovatebot renovate to 44.3.1 (exc)
mend renovate_ce_helm_chart to 15.4.0 (exc)
mend renovate_enterprise_edition_helm_chart to 10.4.0 (exc)
renovate renovate to 44.3.1 (exc)
mend renovate_ce to 15.4.0 (exc)
mend renovate_ee to 15.4.0 (exc)
mend renovate_enterprise_edition to 10.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88884 is an authentication bypass vulnerability in Renovate, a dependency update automation tool. It affects versions before 44.3.1 and related Mend Renovate images and Helm charts. The issue allows digest updates to bypass the internal minimumReleaseAge checks, which are meant to prevent early execution of potentially malicious dependencies in CI workflows.

Detection Guidance

Check Renovate version with `renovate --version` or inspect Docker images for versions before 44.3.1. Verify Helm charts for versions before 15.4.0 (CE/EE) or 10.4.0 (enterprise-edition). Look for repositories using digest updates with `updateType=digest` in Renovate configuration files.

Impact Analysis

This vulnerability could allow an attacker to push a malicious dependency update that bypasses Renovate's stability checks. This might trigger CI workflows prematurely, potentially executing harmful code before the configured minimum release age has elapsed, increasing the risk of supply chain attacks.

Compliance Impact

This vulnerability could undermine compliance with standards like GDPR and HIPAA by allowing potentially malicious dependencies to trigger CI workflows before security controls like minimum release age checks are enforced. This bypasses intended safeguards meant to prevent early execution of untrusted code.

Mitigation Strategies

Upgrade Renovate to version 44.3.1 or later. For Helm deployments, update to 15.4.0 (CE/EE) or 10.4.0 (enterprise-edition). Disable digest updates in Renovate configuration or require `dependencyDashboardApproval` for such updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88884. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart