Executive brief
Renovate is a widely-used automated dependency update tool that manages third-party software packages in code repositories. The tool blindly follows pagination links sent by GitHub servers in HTTP headers without validating whether the links point to legitimate GitHub infrastructure, allowing a compromised GitHub server to redirect Renovate's requests to attacker-controlled hosts and steal configured credentials (API tokens, SSH keys, etc.) that would normally be used to authenticate to GitHub.
Technical details
The vulnerability is a host validation bypass (CWE-601) in Renovate's pagination handling. When Renovate fetches paginated data from GitHub (via repository access, github-releases, github-tags, git-refs, or other datasources), it extracts the "next" pagination URL from the HTTP Link header and automatically follows it, forwarding credentials for the original host. The flaw is that the pagination URL is not validated to ensure it points back to the same GitHub host; a malicious or compromised GitHub server can return a Link header pointing to an attacker-controlled domain, causing Renovate to send authentication credentials to it. The attack requires the GitHub server itself to be already compromised or malicious. The vulnerability is fixed in Renovate 44.11.3 (npm), all Mend Renovate CE/EE container images and Helm charts (versions 15.4.0 and 10.4.0 respectively).
Affected products
- Renovate Renovate < 44.11.3
- Mend Renovate CE < 15.4.0
- Mend Renovate EE Server < 15.4.0
- Mend Renovate EE Worker < 15.4.0
- Mend mend-renovate-ce Helm Chart < 15.4.0
- Mend mend-renovate-enterprise-edition Helm Chart < 10.4.0
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-w57v-h33h-835c published
- 2026-09-10: advisory: CVE-2026-88881 and NVD entry published
- 2026-09-10: patched: Fixes available in Renovate 44.11.3, Mend Renovate CE/EE 15.4.0, mend-renovate-enterprise-edition Helm chart 10.4.0