Renovate before 19.38.7 Credential Exposure via Go Modules
Priority MEDIUM 44CWE-532Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-532.
Summary
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed renovate (renovatebot): 19.38.7
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| renovatebot | renovate | 13.87.0 to before 19.38.7 | 19.38.7 | Patch available | CNA |
- renovate Vendorrenovatebot Affected 13.87.0 to before 19.38.7 Fixed in 19.38.7 Patch available CNA
Remediation
- Fix · CNA renovate (renovatebot) Fixed in 19.38.7
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2019-25766
- 2026-10-03 Alias added: GHSA-3r27-cgcx-x497
References
More renovatebot vulnerabilities
- TI-2026-53338 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager CVSS 4.0HIGH 8.4
- TI-2026-53337 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 CVSS 4.0HIGH 8.4
- TI-2026-53336 Renovate 32.135.0 before 40.33.0 Command Injection via hermit CVSS 4.0HIGH 8.4
- TI-2026-53335 Renovate 35.63.0 before 40.33.0 Command Injection via npm CVSS 4.0HIGH 8.4
- TI-2026-53333 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper CVSS 4.0HIGH 8.4
- TI-2026-60271 Renovate before 44.11.2 Credential Exfiltration via Link Header CVSS 4.0CRITICAL 9.2
Sources
- CVE-2019-25766 · CVE Program
- CVE-2019-25766 · NVD
- FIRST EPSS
- GHSA-3r27-cgcx-x497 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-25766 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences