Renovate is a dependency update automation tool.

Published September 10, 2026 CVE-2026-88882

Renovate, a tool that automatically updates software dependencies, can be tricked into sending a company's package registry login credentials to an attacker's server. This only happens if the NuGet registry Renovate connects to is itself malicious or already compromised.

Severity
HighCVSS 3.1 · 8.6
Fix
Fixed in 44.11.2, 15.4.0, 10.4.0Fix recorded yesterday
Affected versions
before 44.11.2; before 15.4.0; before 10.4.0
Weakness
CWE-601Open Redirect
Exploit likelihood
0.30% in 30 daysEPSS, higher than 23% of known flaws
Affects
Renovate
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: partial
EU ID
EUVD-2026-75432ENISA vulnerability database

How it works

  • Renovate checks NuGet registries for new versions of dependencies and follows pagination links to see further pages of results.
  • The registry sends these pagination links in the HTTP Link header of its response.
  • Renovate attaches its stored registry credentials to the request for that next page without first checking that the link still points to the same registry.
  • A malicious or already-compromised NuGet registry can put a link to an attacker-controlled server in that header, and Renovate then sends its login credentials to that server.
  • Because a compromised registry would already have received the credentials on the first request, this flaw mainly lets those same credentials reach one more attacker-chosen destination.

What to do

Check your Renovate version if you self-host it or run the Mend Renovate CE/EE image or Helm chart, and compare it against the fixed releases in the GitHub advisory. Compare docker.io/renovate/renovate or ghcr.io/renovate/renovate against 44.11.2, docker.io/mend/renovate-ce, renovate-ee-server, renovate-ee-worker and their ghcr.io equivalents against 15.4.0, and the mend-renovate-enterprise-edition Helm chart against 10.4.0. Check whether your Renovate configuration connects to any NuGet registry with stored credentials, since that is the pathway this flaw uses.

Update Renovate to 44.11.2 or later, or update the Mend Renovate CE/EE images and charts to 15.4.0 or later, and the mend-renovate-enterprise-edition Helm chart to 10.4.0 or later, since these releases restrict pagination to the same origin. Do not set the RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN option unless you specifically trust a registry that intentionally serves pagination links from a different host, since it restores the unsafe behavior. Watch the GitHub advisory (GHSA-rh7w-ccch-gh49) for any further guidance if you cannot update immediately.

Technical details

Renovate's NuGet registry client follows Link header pagination without checking that the target has the same origin as the configured registry, so credentials configured for the registry are replayed to whatever host the 'next' link names. Affected: renovate npm/docker before 44.11.2, docker.io/ghcr.io mend/renovate-ce, renovate-ee-server, renovate-ee-worker before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0. CVSS v3.1 8.6 (scope changed), CVSS v4 9.2.

CWE-601, URL Redirection to Untrusted Site. Fixed in 44.11.2 by restricting pagination to same-origin requests; RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN reverts to the old behavior for registries that legitimately paginate cross-origin.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source