Renovate before 44.11.3 fails to validate Link header destinations

Published September 10, 2026 CVE-2026-88880

Renovate can expose authentication credentials to an attacker-controlled server. This requires Renovate to contact a compromised GitLab server.

Severity
HighCVSS 3.1 · 8.6
Fix
Fixed in 44.11.3, 15.4.0, 10.4.0Fix recorded yesterday
Affected versions
before 44.11.3; before 15.4.0; before 10.4.0
Weakness
CWE-601Open Redirect
Exploit likelihood
0.36% in 30 daysEPSS, higher than 29% of known flaws
Affects
Renovate
Exploited
Not confirmedNo confirmation recorded
EU ID
EUVD-2026-75430ENISA vulnerability database

How it works

  • Renovate requests additional GitLab data through page-navigation instructions supplied by the server.
  • Before version 44.11.3, it does not verify that the next-page destination remains on GitLab.
  • A compromised GitLab server can redirect that request to attacker infrastructure, exposing credentials sent with it.

What to do

Run npm list renovate and compare the installed package version with 44.11.3. Versions below 44.11.3 are affected by the npm package record; this check does not determine exposure for other deployment formats.

Run this in the application environment you want to check:

npm list renovate

Update the npm package to Renovate 44.11.3 or later. The advisory text mentions 44.11.2, but the authoritative CVE record identifies 44.11.3 as the fixed npm package version. Compare other deployment formats with the security advisory.

Technical details

The flaw affects Renovate's handling of GitLab pagination links. A compromised GitLab server can supply a Link header that redirects a credential-bearing request to attacker-controlled infrastructure.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source