CVE-2026-88880: Renovate Link header validation bypass in GitLab pagination

CVE-2026-88880 · Severity: high · CVSS 8.6 · Published 2026-09-10

Renovate is a popular dependency management tool used to automatically update software dependencies in repositories. When Renovate fetches updates from a GitLab server, it follows pagination links provided by the server while sending authentication credentials. A compromised or malicious GitLab server can send a specially crafted Link header to redirect these credential-bearing requests to an attacker-controlled server, exfiltrating stored authentication tokens and credentials.

Technologies: Mend Renovate-Ce. Vendors: Mend.

Quick answers

Is CVE-2026-88880 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88880 being exploited in the wild.
How severe is CVE-2026-88880?
High severity, with a CVSS score of 8.6, published 10 September 2026.
Which products and versions are affected?
Mend Renovate Enterprise Server before 15.4.0; Mend Renovate Enterprise Worker before 15.4.0; Mend Renovate-Ce before 15.4.0.
Is there a fix for CVE-2026-88880?
A patch was published on 2026-09-10: Patched in Renovate 44.11.3, Mend distributions 15.4.0, and enterprise charts 10.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88880 attacked?
It is attacked over the network.
Am I affected by CVE-2026-88880?
Check whether you run Mend Renovate Enterprise Server, Mend Renovate Enterprise Worker or Mend Renovate-Ce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a URL redirection/validation bypass (CWE-601) in Renovate's GitLab pagination handling. When following pagination links in the HTTP Link header from a GitLab server, Renovate fails to validate that the destination URL belongs to the original GitLab server before forwarding authentication credentials. An attacker controlling a compromised GitLab instance can inject a malicious Link header pointing to attacker-controlled infrastructure, causing credential-bearing requests to be sent to the attacker's server. The attack requires a compromised GitLab server, but is network-accessible and requires no user interaction or authentication from the attacker's perspective. The vulnerability was patched in Renovate 44.11.3 (and 15.4.0 for enterprise distributions).

Affected products

  • Renovate Renovate before 44.11.3
  • Mend Renovate CE before 15.4.0
  • Mend Renovate Enterprise Server before 15.4.0
  • Mend Renovate Enterprise Worker before 15.4.0

Timeline

  • 2026-08-27: disclosed
  • 2026-09-10: advisory
  • 2026-09-10: patched: Patched in Renovate 44.11.3, Mend distributions 15.4.0, and enterprise charts 10.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.