Read the docs
TI-2026-60265 Aliases CVE-2026-88881GHSA-gwwm-f4gw-c69f

Renovate before 44.11.3 Credential Exfiltration via Link Header

Priority MEDIUM 46CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Spoofing
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601.

Summary

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromised GitHub server can return a `Link` header pointing to an attacker-controlled host and cause Renovate to disclose those credentials to it. Exploitation requires that the GitHub server Renovate talks to (as the repository host or as a datasource such as github-releases, github-tags, or git-refs) is already malicious or compromised. The issue is fixed in renovate 44.11.3 (npm and renovate/renovate container images), Mend Renovate CE/EE images and the mend-renovate-ce helm chart 15.4.0, and the mend-renovate-enterprise-edition helm chart 10.4.0. There is no workaround; the pre-existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check and should only be used with servers that intentionally use different pagination hosts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00409 35th percentileScored 2026-11-07
Fix Fixed renovate (renovatebot): 44.11.3renovate-ce (mend): 15.4.0+4 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
renovatebotrenovatebefore 44.11.344.11.3Patch availableCNA
mendrenovate-cebefore 15.4.015.4.0Patch availableCNA
mendrenovate-ee-serverbefore 15.4.015.4.0Patch availableCNA
mendrenovate-ee-workerbefore 15.4.015.4.0Patch availableCNA
mendmend-renovate-cebefore 15.4.015.4.0Patch availableCNA
mendmend-renovate-enterprise-editionbefore 10.4.010.4.0Patch availableCNA
  • renovate Vendorrenovatebot Affected before 44.11.3 Fixed in 44.11.3 Patch available CNA
  • renovate-ce Vendormend Affected before 15.4.0 Fixed in 15.4.0 Patch available CNA
  • renovate-ee-server Vendormend Affected before 15.4.0 Fixed in 15.4.0 Patch available CNA
  • renovate-ee-worker Vendormend Affected before 15.4.0 Fixed in 15.4.0 Patch available CNA
  • mend-renovate-ce Vendormend Affected before 15.4.0 Fixed in 15.4.0 Patch available CNA
  • mend-renovate-enterprise-edition Vendormend Affected before 10.4.0 Fixed in 10.4.0 Patch available CNA

Remediation

  • Fix · CNA renovate (renovatebot) Fixed in 44.11.3
  • Fix · CNA renovate-ce (mend) Fixed in 15.4.0
  • Fix · CNA renovate-ee-server (mend) Fixed in 15.4.0
  • Fix · CNA renovate-ee-worker (mend) Fixed in 15.4.0
  • Fix · CNA mend-renovate-ce (mend) Fixed in 15.4.0
  • Fix · CNA mend-renovate-enterprise-edition (mend) Fixed in 10.4.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    mend-renovate-ce, mend-renovate-enterprise-edition and 3 more products 10.4.0, 15.4.0

    10 records Highest priority Priority MEDIUM 5 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-60271 Renovate before 44.11.2 Credential Exfiltration via Link HeaderPriority MEDIUM 46
    • TI-2026-60266 Renovate before 44.11.2 Credential Exfiltration via Link HeaderPriority MEDIUM 46
    • TI-2026-60264 Renovate before 44.11.3 Credential Exfiltration via Link HeaderPriority MEDIUM 46
    Show all 10 records →
  • Release ·

    renovatebot renovate 44.11.3

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-60264 Renovate before 44.11.3 Credential Exfiltration via Link HeaderPriority MEDIUM 46
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-88881
  2. 2026-10-03 Alias added: GHSA-gwwm-f4gw-c69f
  3. 2026-10-05 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2026-53338 Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager CVSS 4.0HIGH 8.4
  • TI-2026-53337 Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 CVSS 4.0HIGH 8.4
  • TI-2026-53336 Renovate 32.135.0 before 40.33.0 Command Injection via hermit CVSS 4.0HIGH 8.4
  • TI-2026-53335 Renovate 35.63.0 before 40.33.0 Command Injection via npm CVSS 4.0HIGH 8.4
  • TI-2026-53333 Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper CVSS 4.0HIGH 8.4
  • TI-2026-60271 Renovate before 44.11.2 Credential Exfiltration via Link Header CVSS 4.0CRITICAL 9.2
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences