# CVE-2026-88881: Renovate credential exfiltration via malicious GitHub Link header

Source: https://junglewise.ai/threats/cve-2026-88881-renovate-credential-exfiltration-via-malicious-github-link-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88881 · Severity: high · CVSS 8.6 · Published 2026-09-10

Renovate is a widely-used automated dependency update tool that manages third-party software packages in code repositories. The tool blindly follows pagination links sent by GitHub servers in HTTP headers without validating whether the links point to legitimate GitHub infrastructure, allowing a compromised GitHub server to redirect Renovate's requests to attacker-controlled hosts and steal configured credentials (API tokens, SSH keys, etc.) that would normally be used to authenticate to GitHub.

Technologies: [mend-renovate-ce Helm Chart](https://junglewise.ai/threats/technologies/mend-renovate-ce-helm-chart), [mend-renovate-enterprise-edition Helm Chart](https://junglewise.ai/threats/technologies/mend-renovate-enterprise-edition-helm-chart), [Mend Renovate-Ce](https://junglewise.ai/threats/technologies/renovate-ce), [Mend Renovate-Ee-Server](https://junglewise.ai/threats/technologies/renovate-ee-server), [Mend Renovate-Ee-Worker](https://junglewise.ai/threats/technologies/renovate-ee-worker). Vendors: [Mend](https://junglewise.ai/threats/vendors/mend).

## Quick answers

**Is CVE-2026-88881 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88881 being exploited in the wild.

**How severe is CVE-2026-88881?** High severity, with a CVSS score of 8.6, published 10 September 2026.

**Which products and versions are affected?** mend-renovate-ce Helm Chart < 15.4.0; mend-renovate-enterprise-edition Helm Chart < 10.4.0; Mend Renovate-Ce < 15.4.0; Mend Renovate-Ee-Server < 15.4.0; and 1 more.

**Is there a fix for CVE-2026-88881?** A patch was published on 2026-09-10: Fixes available in Renovate 44.11.3, Mend Renovate CE/EE 15.4.0, mend-renovate-enterprise-edition Helm chart 10.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88881 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88881?** Check whether you run mend-renovate-ce Helm Chart, mend-renovate-enterprise-edition Helm Chart, Mend Renovate-Ce or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a host validation bypass (CWE-601) in Renovate's pagination handling. When Renovate fetches paginated data from GitHub (via repository access, github-releases, github-tags, git-refs, or other datasources), it extracts the "next" pagination URL from the HTTP Link header and automatically follows it, forwarding credentials for the original host. The flaw is that the pagination URL is not validated to ensure it points back to the same GitHub host; a malicious or compromised GitHub server can return a Link header pointing to an attacker-controlled domain, causing Renovate to send authentication credentials to it. The attack requires the GitHub server itself to be already compromised or malicious. The vulnerability is fixed in Renovate 44.11.3 (npm), all Mend Renovate CE/EE container images and Helm charts (versions 15.4.0 and 10.4.0 respectively).

## Affected products

- Renovate Renovate < 44.11.3
- Mend Renovate CE < 15.4.0
- Mend Renovate EE Server < 15.4.0
- Mend Renovate EE Worker < 15.4.0
- Mend mend-renovate-ce Helm Chart < 15.4.0
- Mend mend-renovate-enterprise-edition Helm Chart < 10.4.0

## Timeline

- 2026-08-27: disclosed: GitHub Security Advisory GHSA-w57v-h33h-835c published
- 2026-09-10: advisory: CVE-2026-88881 and NVD entry published
- 2026-09-10: patched: Fixes available in Renovate 44.11.3, Mend Renovate CE/EE 15.4.0, mend-renovate-enterprise-edition Helm chart 10.4.0

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-w57v-h33h-835c](https://github.com/renovatebot/renovate/security/advisories/GHSA-w57v-h33h-835c)
- [https://www.vulncheck.com/advisories/renovate-before-44.11.3-credential-exfiltration-via-link-header-2](https://www.vulncheck.com/advisories/renovate-before-44.11.3-credential-exfiltration-via-link-header-2)

## Related threats

- [Renovate server-side request forgery in HTTP presets](https://junglewise.ai/threats/cve-2026-110868-renovate-before-44-79-0-contains-a-server-side-request-forgery)
- [Renovate environment variable allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110867-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate protection mechanism bypass in minimumReleaseAge checks](https://junglewise.ai/threats/cve-2026-110866-renovate-before-44-61-3-contains-a-protection-mechanism-bypass)
- [Renovate HTTP header allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110865-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate command injection in Maven Wrapper manager](https://junglewise.ai/threats/cve-2026-88889-renovate-command-injection-in-maven-wrapper-manager)