CVE-2026-88884 in Renovate
Summary
by MITRE • 09/10/2026
Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0), digest updates are not subject to the internal `minimumReleaseAge` (stability age) checks. When a repository configures `minimumReleaseAge` and has dependencies with `updateType=digest` — for example GitHub Actions pinned to a commit SHA with a floating tag, Docker images, Go modules or NuGet packages — Renovate will still open a pull request for a newly published digest, marked only with a pending `renovate/stability-days` status check. A newly published, potentially malicious dependency version can therefore cause a PR to be raised and CI workflows to potentially run before the configured minimum release age has elapsed, which is precisely what the Minimum Release Age control is intended to prevent. The issue is fixed in Renovate 44.3.1; as a workaround, digest updates can be disabled or gated behind `dependencyDashboardApproval`.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
Renovate serves as a critical automation tool for managing dependency updates within software development workflows, yet versions prior to 44.3.1 contain a logic flaw that undermines the stability controls designed to protect against supply chain attacks. The vulnerability specifically affects Mend Renovate Community Edition and Enterprise Edition images before version 15.4.0, as well as their corresponding Helm charts released before versions 15.4.0 and 10.4.0 respectively. This issue arises because the internal mechanism responsible for enforcing minimum release age checks fails to apply its constraints to digest-based updates. In typical usage scenarios where developers configure a repository with a stability threshold, such as requiring dependencies to exist in public registries for a set number of days before being updated, this oversight allows newly published digests to bypass these safeguards entirely.
The technical flaw manifests when repositories are configured with the minimumReleaseAge setting and include dependencies that utilize updateType=digest. Common examples of such dependencies include GitHub Actions pinned to specific commit SHAs using floating tags, Docker images referenced by digest, Go modules, or NuGet packages updated via hash verification. Under normal circumstances, Renovate should delay creating pull requests for these updates until the configured stability period has elapsed. However, due to this vulnerability, the tool proceeds to open a pull request immediately upon detecting a new digest, marking it only with a pending renovate/stability-days status check rather than withholding the update entirely. This behavior effectively neutralizes the protective intent of the minimum release age configuration for a significant subset of dependency types that rely on immutable identifiers like SHA-256 hashes.
The operational impact of this vulnerability is substantial from a security perspective, as it directly facilitates potential supply chain attacks through automated CI/CD pipelines. By allowing pull requests to be raised and subsequently triggering continuous integration workflows before the minimum release age has passed, attackers can exploit newly published malicious dependency versions that have not yet been vetted by the community or security teams. This bypasses a key defense-in-depth control intended to provide time for vulnerability disclosure and mitigation analysis. The execution of CI workflows with unvetted dependencies increases the risk of introducing compromised code into the build environment, potentially leading to downstream propagation of malicious artifacts if subsequent stages trust the output without additional verification.
This flaw aligns closely with CWE-20 Improper Input Validation, as the application fails to properly validate whether a digest update meets the stability criteria before initiating actions that could impact system integrity. Furthermore, it relates to ATT&CK technique T1195 Supply Chain Compromise, specifically where an attacker exploits trusted software updates or dependencies to infiltrate a target environment. The vulnerability highlights the importance of ensuring that all automated dependency management tools strictly adhere to configured security policies across all update types, including those based on immutable digests which are often perceived as more secure but remain vulnerable if configuration logic is incomplete.
To mitigate this risk, organizations should upgrade Renovate and its associated Helm charts to version 44.3.1 or later for the main application and versions 15.4.0 and 10.4.0 respectively for the container images and charts. For environments where an immediate upgrade is not feasible, a recommended workaround involves disabling digest updates entirely within the repository configuration. Alternatively, administrators can gate these updates behind dependencyDashboardApproval, which requires manual intervention before any pull requests are created or merged. This approach ensures that even if a new malicious digest is published, it will not automatically trigger CI workflows until a human operator has reviewed and approved the change, thereby restoring the intended security posture of the minimum release age control.