CVE-2026-88887
Undergoing Analysis Undergoing Analysis - In Progress

Cross-Origin Credential Leak in Renovate Container Registry

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: VulnCheck

Description
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has the same origin as the original registry. A malicious or compromised container registry can therefore specify a Link header pointing to an attacker-controlled host and receive the credentials Renovate uses for that registry. Exploitation requires that the target has container (Docker) dependencies and is already interacting with the malicious or compromised registry. This is fixed in Renovate 44.11.2 (npm and renovate/renovate images), Mend Renovate CE/EE 15.4.0 and the mend-renovate-enterprise-edition Helm chart 10.4.0; the same-origin check can be disabled with RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88887
EUVD
EUVD-2026-75437

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
renovatebot renovate 44.11.2
mend renovate 44.11.2
mend renovate_ce 15.4.0
mend renovate_ee 15.4.0
mend renovate_enterprise_edition 10.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Renovate is a tool that automates dependency updates. When it requests container image tags or digests from a registry, it follows pagination links provided in the HTTP Link header. If a registry is malicious or compromised, it can redirect Renovate to an attacker-controlled server via this header, causing Renovate to send registry credentials to the wrong host. This happens because Renovate does not verify the origin of the pagination URL.

Detection Guidance

Detecting this vulnerability requires monitoring network traffic for unexpected cross-origin requests during Docker registry interactions. Check Renovate logs for outbound connections to unexpected hosts during container image tag/digest listing. Use tools like tcpdump or Wireshark to inspect HTTP Link headers in responses from Docker registries. Verify if Renovate sends credentials to non-registry domains.

Impact Analysis

If you use Renovate with container dependencies and interact with a compromised registry, an attacker could steal your registry credentials. This could lead to unauthorized access to your container images or other resources protected by those credentials. The attack requires the registry to be compromised first.

Compliance Impact

This vulnerability could lead to unauthorized access to credentials used for container registries, potentially exposing sensitive data. For GDPR, this may result in unauthorized data processing or breaches requiring notification under Article 33. For HIPAA, compromised credentials could allow access to protected health information, violating safeguards under the Security Rule.

Mitigation Strategies

Upgrade Renovate to version 44.11.2 or later. For Mend Renovate CE/EE, update to 15.4.0 or later. If using Helm, upgrade the mend-renovate-enterprise-edition chart to 10.4.0. Alternatively, disable cross-origin pagination by setting RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN=false. Rotate exposed registry credentials as a precaution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart