CVE-2026-88881 in Renovate
Summary
by MITRE • 09/10/2026
Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromised GitHub server can return a `Link` header pointing to an attacker-controlled host and cause Renovate to disclose those credentials to it. Exploitation requires that the GitHub server Renovate talks to (as the repository host or as a datasource such as github-releases, github-tags, or git-refs) is already malicious or compromised. The issue is fixed in renovate 44.11.3 (npm and renovate/renovate container images), Mend Renovate CE/EE images and the mend-renovate-ce helm chart 15.4.0, and the mend-renovate-enterprise-edition helm chart 10.4.0. There is no workaround; the pre-existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check and should only be used with servers that intentionally use different pagination hosts.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in Renovate, a widely adopted dependency update automation tool, centers on an insecure handling of HTTP Link headers during API interactions with GitHub services including GitHub.com, GitHub Enterprise Cloud, and GitHub Enterprise Server. When querying for paginated results such as repository lists or release tags, the application relies on pagination links provided by the server within the HTTP response's Link header to fetch subsequent pages of data. The critical technical flaw lies in the absence of host validation for these next-page URLs. Instead of verifying that the destination URL belongs to the same trusted domain originally contacted, Renovate blindly follows any link presented in the header and transmits all configured authentication credentials associated with that host context. This behavior creates a direct path for credential exfiltration if an attacker can manipulate the server's response headers.
From a technical perspective, this flaw represents a classic case of insecure redirection or open redirect leading to sensitive information exposure. The application fails to enforce strict origin checks on URLs derived from external inputs, specifically HTTP headers which are often considered untrusted in security contexts due to their susceptibility to manipulation by intermediaries or compromised servers. By trusting the Link header without validation, Renovate effectively acts as a proxy for credential theft when interacting with malicious infrastructure. This aligns closely with CWE-601, URL Redirection to Untrusted Site, and CWE-209, Generation of Error Message Containing Sensitive Information, although in this specific instance, the primary concern is the unauthorized disclosure of secrets rather than error message leakage. The vulnerability allows an attacker who controls or compromises a GitHub server endpoint used by Renovate to redirect traffic to a malicious host where they can capture tokens and API keys intended for legitimate use.
The operational impact of this vulnerability is severe but contingent on specific preconditions. Exploitation requires that the GitHub server acting as the repository host or datasource, such as github-releases, github-tags, or git-refs, is already compromised or controlled by an attacker. This means the threat model assumes a breach at the infrastructure level rather than a remote code execution vulnerability within Renovate itself. However, given that CI/CD pipelines and automated development workflows frequently rely on these credentials to push updates and manage dependencies, the compromise of such credentials can lead to supply chain attacks. An attacker could use stolen tokens to inject malicious code into repositories or publish compromised packages under trusted identities, thereby undermining the integrity of downstream software projects. This scenario is relevant to MITRE ATT&CK techniques involving Credential Access through Unsecured Credentials and potentially T1078 Valid Accounts if the stolen credentials allow further lateral movement within an organization's ecosystem.
Mitigation strategies are primarily focused on upgrading to patched versions where this validation logic has been implemented. The issue was resolved in Renovate version 44.11.3 for npm packages and container images, as well as specific releases of Mend Renovate CE/EE images and Helm charts including mend-renovate-ce chart 15.4.0 and mend-renovate-enterprise-edition chart 10.4.0. Organizations must ensure their CI/CD environments are updated to these versions immediately to prevent credential leakage. There is no viable workaround for existing installations other than upgrading, as the underlying architectural trust model requires code changes to enforce host validation. Additionally, users should be aware of the RENOVATE_X_REBASE_PAGINATION_LINKS environment variable; while this option exists to disable the new host check, it was introduced specifically for scenarios where legitimate infrastructure uses different pagination hosts and should not be enabled in standard environments as doing so would reintroduce the vulnerability by bypassing the security controls added in the patch.