Executive brief
Renovate is a popular dependency management tool used to automatically update software dependencies in repositories. When Renovate fetches updates from a GitLab server, it follows pagination links provided by the server while sending authentication credentials. A compromised or malicious GitLab server can send a specially crafted Link header to redirect these credential-bearing requests to an attacker-controlled server, exfiltrating stored authentication tokens and credentials.
Technical details
The vulnerability is a URL redirection/validation bypass (CWE-601) in Renovate's GitLab pagination handling. When following pagination links in the HTTP Link header from a GitLab server, Renovate fails to validate that the destination URL belongs to the original GitLab server before forwarding authentication credentials. An attacker controlling a compromised GitLab instance can inject a malicious Link header pointing to attacker-controlled infrastructure, causing credential-bearing requests to be sent to the attacker's server. The attack requires a compromised GitLab server, but is network-accessible and requires no user interaction or authentication from the attacker's perspective. The vulnerability was patched in Renovate 44.11.3 (and 15.4.0 for enterprise distributions).
Affected products
- Renovate Renovate before 44.11.3
- Mend Renovate CE before 15.4.0
- Mend Renovate Enterprise Server before 15.4.0
- Mend Renovate Enterprise Worker before 15.4.0
Timeline
- 2026-08-27: disclosed
- 2026-09-10: advisory
- 2026-09-10: patched: Patched in Renovate 44.11.3, Mend distributions 15.4.0, and enterprise charts 10.4.0