CVE-2026-88880: Renovate before 44.11.3 Credential Exfiltration via Link Header

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-10 · updated 2026-09-29
Weakness: CWE-601

Description

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.

Affected products

mend-renovate-ce: before 15.4.0 — fixed in 15.4.0
mend-renovate-enterprise-edition: before 10.4.0 — fixed in 10.4.0
mend renovate-ce: before 15.4.0 — fixed in 15.4.0
mend renovate-ee-server: before 15.4.0 — fixed in 15.4.0
mend renovate-ee-worker: before 15.4.0 — fixed in 15.4.0
renovatebot renovate: before 44.11.3 — fixed in 44.11.3

How to fix

Upgrade to a fixed version: mend-renovate-ce 15.4.0; mend-renovate-enterprise-edition 10.4.0; mend renovate-ce 15.4.0; mend renovate-ee-server 15.4.0; mend renovate-ee-worker 15.4.0; renovatebot renovate 44.11.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-88880 or the next vulnerability affects your stack