🔐 CVE Alert

CVE-2026-88880

HIGH 8.6

Renovate before 44.11.3 Credential Exfiltration via Link Header

CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.

CWE CWE-601
Vendor renovatebot
Product renovate
Published Sep 10, 2026
Stay Ahead of the Next One

Get instant alerts for renovatebot renovate

Be the first to know when new high vulnerabilities affecting renovatebot renovate are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Affected Versions

renovatebot / renovate
0 < 44.11.3
renovatebot / renovate
0 < 44.11.3
renovatebot / renovate
0 < 44.11.3
renovatebot / renovate
0 < 44.11.3
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 15.4.0
renovatebot / renovate
0 < 10.4.0
renovatebot / renovate
0 < 10.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗
github.com: https://github.com/renovatebot/renovate/security/advisories/GHSA-9hmg-9h89-jhmx vulncheck.com: https://www.vulncheck.com/advisories/renovate-before-44.11.3-credential-exfiltration-via-link-header

Credits

🔍 jamietanna