CVE-2026-88882 renovatebot CVE debrief

Who should care

DevOps teams, security teams, and administrators using Renovate for dependency update automation should review and update to a secure version, verify pagination URL origins, and monitor for suspicious activity related to registry credentials. They should also confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Why it matters

A critical vulnerability in Renovate allows for credential exfiltration via a malicious or compromised NuGet registry. DevOps teams, security teams, and administrators using Renovate should review and update to a secure version, verify pagination URL origins, and monitor for suspicious activity.

• Potential credential exfiltration to an attacker-controlled server
• Possible unauthorized access to registry credentials
• Need for verification of pagination URL origins
• Requirement for updating Renovate to a secure version

Technical summary

The vulnerability is caused by Renovate's handling of pagination URLs in the HTTP `Link` header without verifying the target's origin. This could lead to registry credentials being sent to an attacker-controlled server. Affected versions include those before 44.11.2 and certain Mend Renovate CE/EE images and charts. The fix restricts pagination to the same origin, preventing credential exfiltration to unauthorized servers. DevOps teams should review and update affected deployments to a secure version promptly, and verify pagination URL origins.

Defensive priority

High

Recommended defensive actions

• Review and update Renovate to version 44.11.2 or later
• Verify the origin of pagination URLs in the HTTP `Link` header
• Monitor for suspicious activity related to registry credentials
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. The issue is caused by Renovate's handling of pagination URLs in the HTTP `Link` header. The fix restricts pagination to the same origin. Source confidence is limited to public CVE and NVD records. Affected scope and impact are unclear beyond stated versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.