CVE-2026-88887 in Renovate
Summary
by MITRE • 09/10/2026
Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has the same origin as the original registry. A malicious or compromised container registry can therefore specify a Link header pointing to an attacker-controlled host and receive the credentials Renovate uses for that registry. Exploitation requires that the target has container (Docker) dependencies and is already interacting with the malicious or compromised registry. This is fixed in Renovate 44.11.2 (npm and renovate/renovate images), Mend Renovate CE/EE 15.4.0 and the mend-renovate-enterprise-edition Helm chart 10.4.0; the same-origin check can be disabled with RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
Renovate is a widely adopted dependency update automation tool designed to streamline the process of keeping software dependencies current by automatically creating pull requests for updates. In its standard operation, Renovate interacts with various package registries and container image repositories to fetch metadata such as available tags or digests. This interaction often involves handling HTTP responses that include pagination information, allowing the tool to retrieve large sets of data in manageable chunks. The security flaw identified here stems from how Renovate handles these pagination links when querying container images stored in remote registries like Docker Hub or private Harbor instances. Specifically, when a registry returns an HTTP Link header containing URLs for subsequent pages of results, Renovate follows these links by making follow-up requests to the specified destinations.
The core technical vulnerability lies in the absence of origin verification during this pagination process. When Renovate encounters a Link header with a URL pointing to a different host than the original registry it was querying, it proceeds to attach the authentication credentials intended for the original registry to these new requests without validating that the destination matches the expected domain or scheme. This behavior violates the principle of same-origin policy, which is critical in preventing credential leakage across untrusted domains. Consequently, if an attacker controls a container registry or compromises one through supply chain attacks such as typosquatting or malicious package injection, they can manipulate the HTTP response headers to include pagination links pointing to their own infrastructure.
The operational impact of this vulnerability is significant for organizations relying on Renovate for automated dependency management. An attacker who successfully exploits this flaw can intercept sensitive authentication tokens and credentials that Renovate uses to access private container registries. These credentials often grant read or write access to internal repositories, potentially exposing proprietary source code, configuration files, or other intellectual property stored within those images. Furthermore, possession of these registry credentials could allow an attacker to push malicious updates back into the organization's supply chain, leading to widespread compromise if downstream systems automatically pull and deploy these tainted artifacts. The exploitation scenario requires that the target system is configured with container dependencies and actively interacts with a malicious or compromised registry, making it particularly relevant for environments using private registries where credential management is critical.
This vulnerability aligns with CWE-200, which covers exposure of sensitive information to an unauthorized actor, as well as CWE-384 regarding session fixation in the context of improper token handling across different origins. From a threat modeling perspective consistent with MITRE ATT&CK techniques, this behavior facilitates Credential Access via Unsecured Credentials and potentially Information Exfiltration over C2 Channels if the attacker uses the stolen tokens to exfiltrate data from other protected registries they have access to using those credentials. The risk is amplified in automated CI/CD pipelines where Renovate runs with elevated privileges or broad registry access scopes, increasing the blast radius of a successful credential theft incident.
Mitigation strategies focus on both immediate configuration changes and long-term architectural improvements. For users unable to upgrade immediately, setting the environment variable RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN to false enforces strict origin checking, ensuring that pagination requests are only followed if they point back to the original registry domain. However, this is a workaround rather than a complete fix and may break functionality for legitimate registries using cross-origin CDN links for pagination data. The recommended permanent solution is to upgrade Renovate to version 44.11.2 or later on npm and Docker Hub images, Mend Renovate Community Edition/Enterprise Edition version 15.4.0, or the mend-renovate-enterprise-edition Helm chart version 10.4.0. These updated versions implement proper validation of pagination URLs against the original registry's origin before attaching credentials, thereby neutralizing the attack vector described in this vulnerability report.