Renovate is a dependency update automation tool.

Published September 10, 2026 CVE-2026-88887

A bug in Renovate, a tool that automatically updates software dependencies, could let a malicious or hacked container registry steal the login credentials Renovate uses to talk to it. This only matters if that registry is already compromised.

Severity
HighCVSS 3.1 · 8.6
Fix
Fixed in 44.11.2, 15.4.0, 10.4.0Fix recorded yesterday
Affected versions
before 44.11.2; before 15.4.0; before 10.4.0
Weakness
CWE-601Open Redirect
Exploit likelihood
0.30% in 30 daysEPSS, higher than 23% of known flaws
Affects
Renovate
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: yes · Technical impact: partial
EU ID
EUVD-2026-75437ENISA vulnerability database

How it works

  • Renovate checks container registries for new image tags and digests.
  • When a registry sends back a paginated list, it follows a "next page" link supplied in the registry's own Link header.
  • Renovate did not check whether that next-page link pointed back to the same registry.
  • A malicious or already-compromised registry could put an attacker-controlled address in that Link header instead.
  • Renovate would then send its stored registry credentials to that attacker-controlled address.

What to do

Check your Renovate version: run npm list renovate if you install it via npm, or check the tag of the renovate/renovate Docker image your pipeline pulls. If you use Mend Renovate CE/EE, check whether it is below 15.4.0, or below 10.4.0 for the mend-renovate-enterprise-edition Helm chart. This only puts you at risk if Renovate also updates container (Docker) image dependencies and talks to a registry that turns out to be malicious or compromised.

Run this in the application environment you want to check:

npm list renovate

Update to Renovate 44.11.2 or later for the npm package and renovate/renovate Docker image. Update Mend Renovate CE/EE to 15.4.0 or later, and the mend-renovate-enterprise-edition Helm chart to 10.4.0 or later. Do not set the environment variable RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN unless you specifically trust a registry that intentionally uses a different host for its pagination links, since it turns this protection back off. Watch the GitHub advisory GHSA-v73q-hvqx-hxwx for any further guidance.

Technical details

Renovate paginates container registry tag/digest listings by following the URL in the HTTP Link header returned by the registry, and it attaches the registry's stored credentials to that follow-up request. Prior to the fix, Renovate did not verify the pagination URL shared the same origin as the original registry, so a malicious or compromised registry could set the Link header to an attacker-controlled host and receive those credentials. The precondition is that Renovate is already interacting with a registry that is malicious or has been compromised; the GitHub advisory notes that in that case the registry operator likely already obtained the credentials from the initial request. Fixed in Renovate 44.11.2, Mend Renovate CE/EE 15.4.0, and the mend-renovate-enterprise-edition Helm chart 10.4.0.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact None No data tampering
  • Availability impact None No availability impact
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Open in FIRST.org calculator

References

View Original Source