Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header

Published September 10, 2026 CVE-2026-88881

Renovate, a tool that automatically updates software dependencies, could leak the login credentials it uses for GitHub to an attacker's server. This only happens if the GitHub server Renovate connects to is itself already malicious or hacked.

Severity
HighCVSS 3.1 · 8.6
Fix
Fixed in 44.11.3, 15.4.0, 10.4.0Fix recorded yesterday
Affected versions
before 44.11.3; before 15.4.0; before 10.4.0
Weakness
CWE-601Open Redirect
Exploit likelihood
0.30% in 30 daysEPSS, higher than 23% of known flaws
Affects
Renovate
Exploited
Not confirmedNo confirmation recorded
EU ID
EUVD-2026-75431ENISA vulnerability database

How it works

  • Renovate fetches lists of data from GitHub, such as releases or tags, in multiple pages.
  • When a page of results is not complete, the GitHub server tells Renovate where to find the next page using a technical instruction called the Link header.
  • Renovate trusted that instruction completely and sent along its GitHub login credentials to whatever address the header pointed.
  • It never checked that the address still belonged to the same GitHub server it started talking.
  • If that GitHub server is malicious or has been taken over by an attacker, it can point the next page to a server the attacker controls and collect Renovate's credentials.

What to do

Check which version of Renovate you run with npm list renovate if you installed it via npm, or check the tag of the renovate/renovate, docker.io/mend/renovate-ce, or ghcr.io/mend/renovate-ce container image you deploy. Compare that version against the GitHub security advisory, which lists 44.11.3, 15.4.0, and 10.4.0 as the fixed releases for the different packages. Check whether you have set the RENOVATE_X_REBASE_PAGINATION_LINKS environment variable, since that setting turns off the new protection and should only be used if you deliberately connect to a GitHub server that uses a different pagination host.

Run this in the application environment you want to check:

npm list renovate

Update to Renovate 44.11.3 if you installed it through npm or run the renovate/renovate container image. Update to Mend Renovate CE or EE container images and the mend-renovate-ce helm chart to version 15.4.0, or the mend-renovate-enterprise-edition helm chart to version 10.4.0, if you use those instead. Remove or avoid setting RENOVATE_X_REBASE_PAGINATION_LINKS unless you specifically need it for a GitHub server that intentionally uses a different pagination address, since it disables the fix's protection. Watch the GitHub security advisory for any further guidance, since there is no other workaround.

Technical details

Renovate paginates GitHub API responses (github-releases, github-tags, git-refs, github-digest, and related datasources) by following the URL supplied in the HTTP Link header's 'next' relation, and it attached the credentials configured for the originating host to that follow-up request without validating the new URL's host. A malicious or compromised GitHub.com, GHEC, or GHES instance could therefore set the Link header to an attacker-controlled origin and receive Renovate's credentials for that host. Exploitation requires the GitHub server Renovate is already talking to be malicious or compromised; per the GitHub advisory, this mainly gives an already-compromised registry a new exfiltration destination rather than a fresh compromise vector.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source