{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-88882", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-10T11:25:34.912Z", "datePublished": "2026-09-10T13:05:33.310Z", "dateUpdated": "2026-09-10T14:09:13.720Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-10T13:05:33.310Z" }, "datePublic": "2026-08-27T00:00:00.000Z", "title": "Renovate before 44.11.2 Credential Exfiltration via Link Header", "descriptions": [ { "lang": "en", "value": "Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0), when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by the registry in the HTTP `Link` header without verifying that the target has the same origin as the configured registry. Registry credentials are attached to the request for the 'next' page, so a malicious or compromised NuGet registry can return a `Link` header pointing at an attacker-controlled server and cause Renovate to send the registry credentials to that server. Exploitation requires the remote registry to be malicious or compromised; such a registry would normally already have received the credentials on the initial request, so the issue primarily allows the credentials to be delivered to an additional, attacker-chosen host. The fix restricts pagination to the same origin; the previous behaviour can be re-enabled with the RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN option." } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "description": "URL Redirection to Untrusted Site ('Open Redirect')", "cweId": "CWE-601", "type": "CWE" } ] } ], "affected": [ { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "packageURL": "pkg:npm/renovate", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "44.11.2" }, { "version": "44.11.2", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "44.11.2" }, { "version": "44.11.2", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "44.11.2" }, { "version": "44.11.2", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "44.11.2" }, { "version": "44.11.2", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "15.4.0" }, { "version": "15.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "10.4.0" }, { "version": "10.4.0", "status": "unaffected", "versionType": "semver" } ] }, { "vendor": "renovatebot", "product": "renovate", "defaultStatus": "unaffected", "versions": [ { "version": "0", "status": "affected", "versionType": "semver", "lessThan": "10.4.0" }, { "version": "10.4.0", "status": "unaffected", "versionType": "semver" } ] } ], "metrics": [ { "format": "CVSS", "cvssV4_0": { "version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.2, "baseSeverity": "CRITICAL" } }, { "format": "CVSS", "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH" } } ], "references": [ { "url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-rh7w-ccch-gh49", "tags": [ "vendor-advisory" ], "name": "GitHub Security Advisory (GHSA-rh7w-ccch-gh49)" }, { "name": "VulnCheck Advisory: Renovate before 44.11.2 Credential Exfiltration via Link Header", "tags": [ "third-party-advisory" ], "url": "https://www.vulncheck.com/advisories/renovate-before-44.11.2-credential-exfiltration-via-link-header" } ], "credits": [ { "lang": "en", "value": "jamietanna", "type": "reporter" } ], "x_generator": { "engine": "vulncheck-endgame" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-09-10T14:09:03.832818Z", "id": "CVE-2026-88882", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-10T14:09:13.720Z" } } ] } }