renovatebot Renovate Log Sanitization httpsPrivateKey missing encryption

Summaryinfo

A vulnerability, which was classified as problematic, has been found in renovatebot Renovate. The affected element is an unknown function of the component Log Sanitization. This manipulation of the argument httpsPrivateKey causes missing encryption. This vulnerability is tracked as CVE-2026-88883. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as problematic was found in renovatebot Renovate (affected version unknown). Affected by this vulnerability is an unknown functionality of the component Log Sanitization. The manipulation of the argument httpsPrivateKey with an unknown input leads to a missing encryption vulnerability. The CWE definition for the vulnerability is CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. As an impact it is known to affect confidentiality. The summary by CVE is:

Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0), log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of hostRules[].httpsPrivateKey was redacted in the field itself, the same private key value was not redacted if it also appeared elsewhere — for example in another configuration option or in a log message under a key other than httpsPrivateKey — causing the full private key to be written to Renovate's logs in cleartext. This affects deployments that configure Mutual TLS through hostRules[].httpsPrivateKey without passing the value through the documented `secrets` configuration. Anyone able to read the resulting logs can recover the private key. The issue is fixed in Renovate 44.14.4, which redacts any value supplied as hostRules[].httpsPrivateKey wherever it appears in the logs; as a workaround, supply the key via the `secrets` configuration.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-88883 since 09/10/2026. The exploitation appears to be difficult. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• renovatebot

Name

• Renovate

Website

• Product: https://github.com/renovatebot/renovate/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion