# CVE-2026-88880: Renovate Link header validation bypass in GitLab pagination

Source: https://junglewise.ai/threats/cve-2026-88880-renovate-link-header-validation-bypass-in-gitlab-pagination  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88880 · Severity: high · CVSS 8.6 · Published 2026-09-10

Renovate is a popular dependency management tool used to automatically update software dependencies in repositories. When Renovate fetches updates from a GitLab server, it follows pagination links provided by the server while sending authentication credentials. A compromised or malicious GitLab server can send a specially crafted Link header to redirect these credential-bearing requests to an attacker-controlled server, exfiltrating stored authentication tokens and credentials.

Technologies: [Mend Renovate-Ce](https://junglewise.ai/threats/technologies/renovate-ce). Vendors: [Mend](https://junglewise.ai/threats/vendors/mend).

## Quick answers

**Is CVE-2026-88880 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88880 being exploited in the wild.

**How severe is CVE-2026-88880?** High severity, with a CVSS score of 8.6, published 10 September 2026.

**Which products and versions are affected?** Mend Renovate Enterprise Server before 15.4.0; Mend Renovate Enterprise Worker before 15.4.0; Mend Renovate-Ce before 15.4.0.

**Is there a fix for CVE-2026-88880?** A patch was published on 2026-09-10: Patched in Renovate 44.11.3, Mend distributions 15.4.0, and enterprise charts 10.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88880 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88880?** Check whether you run Mend Renovate Enterprise Server, Mend Renovate Enterprise Worker or Mend Renovate-Ce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a URL redirection/validation bypass (CWE-601) in Renovate's GitLab pagination handling. When following pagination links in the HTTP Link header from a GitLab server, Renovate fails to validate that the destination URL belongs to the original GitLab server before forwarding authentication credentials. An attacker controlling a compromised GitLab instance can inject a malicious Link header pointing to attacker-controlled infrastructure, causing credential-bearing requests to be sent to the attacker's server. The attack requires a compromised GitLab server, but is network-accessible and requires no user interaction or authentication from the attacker's perspective. The vulnerability was patched in Renovate 44.11.3 (and 15.4.0 for enterprise distributions).

## Affected products

- Renovate Renovate before 44.11.3
- Mend Renovate CE before 15.4.0
- Mend Renovate Enterprise Server before 15.4.0
- Mend Renovate Enterprise Worker before 15.4.0

## Timeline

- 2026-08-27: disclosed
- 2026-09-10: advisory
- 2026-09-10: patched: Patched in Renovate 44.11.3, Mend distributions 15.4.0, and enterprise charts 10.4.0

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-9hmg-9h89-jhmx](https://github.com/renovatebot/renovate/security/advisories/GHSA-9hmg-9h89-jhmx)
- [https://www.vulncheck.com/advisories/renovate-before-44.11.3-credential-exfiltration-via-link-header](https://www.vulncheck.com/advisories/renovate-before-44.11.3-credential-exfiltration-via-link-header)

## Related threats

- [Renovate server-side request forgery in HTTP presets](https://junglewise.ai/threats/cve-2026-110868-renovate-before-44-79-0-contains-a-server-side-request-forgery)
- [Renovate environment variable allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110867-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate protection mechanism bypass in minimumReleaseAge checks](https://junglewise.ai/threats/cve-2026-110866-renovate-before-44-61-3-contains-a-protection-mechanism-bypass)
- [Renovate HTTP header allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110865-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate command injection in Maven Wrapper manager](https://junglewise.ai/threats/cve-2026-88889-renovate-command-injection-in-maven-wrapper-manager)