CVE-2020-37267
Renovate 19.180.0 before 23.25.1 Token Leakage via Logs
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.
| CWE | CWE-532 |
| Vendor | renovatebot |
| Product | renovate |
| Published | Aug 19, 2026 |
| Last Updated | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for renovatebot renovate
Be the first to know when new high vulnerabilities affecting renovatebot renovate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
renovatebot / renovate
19.180.0 < 23.25.1
References
Credits
ylemkimon