CVE-2019-25766: Renovate before 19.38.7 Credential Exposure via Go Modules

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-19 · updated 2026-09-08
Weakness: CWE-532

Description

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

Affected products

renovatebot renovate: from 13.87.0 before 19.38.7 — fixed in 19.38.7

How to fix

Upgrade to a fixed version: renovatebot renovate 19.38.7. Check the vendor advisory for mitigations.

References

https://github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg
https://www.vulncheck.com/advisories/renovate-before-credential-exposure-via-go-modules

Get alerted when CVE-2019-25766 or the next vulnerability affects your stack