CVE-2026-88882: Renovate NuGet credential exfiltration via Link header

CVE-2026-88882 · Severity: high · CVSS 8.6 · Published 2026-09-10

Renovate is a dependency update automation tool used to keep software dependencies current. When querying NuGet registries for package updates, Renovate blindly follows pagination links in HTTP headers without verifying they point to the legitimate registry. A malicious or compromised NuGet registry can exploit this to redirect credential-bearing requests to an attacker-controlled server, exposing registry credentials. While the registry typically has credentials from the initial request, this vulnerability allows an attacker to harvest credentials on a secondary target.

Technologies: Mend Renovate-Ce, Mend Renovate-Ee-Server, Mend Renovate-Ee-Worker. Vendors: Mend.

Quick answers

Is CVE-2026-88882 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88882 being exploited in the wild.
How severe is CVE-2026-88882?
High severity, with a CVSS score of 8.6, published 10 September 2026.
Which products and versions are affected?
Mend-Renovate-Enterprise-Edition before 10.4.0; Mend Renovate-Ce before 15.4.0; Mend Renovate-Ee-Server before 15.4.0; Mend Renovate-Ee-Worker before 15.4.0.
Is there a fix for CVE-2026-88882?
A patch was published on 2026-09-10: Renovate 44.11.2, Mend CE/EE 15.4.0, and mend-renovate-enterprise-edition 10.4.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88882 attacked?
It is attacked over the network.
Am I affected by CVE-2026-88882?
Check whether you run Mend-Renovate-Enterprise-Edition, Mend Renovate-Ce, Mend Renovate-Ee-Server or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an open redirect / cross-origin credential leak in Renovate's NuGet registry pagination logic. When Renovate pages through search results from a NuGet registry, it follows the `Link` HTTP header provided by the remote registry without validating that the pagination URL has the same origin as the configured registry. Since authentication credentials are attached to all requests to the registry, an attacker controlling or compromising a NuGet registry can craft a malicious `Link` header pointing to an attacker-controlled server, causing Renovate to send the registry credentials to that server. Exploitation requires the NuGet registry itself to be compromised or malicious; no user interaction or authentication is needed. The vulnerability has been fixed in Renovate 44.11.2 and Mend CE/EE versions 15.4.0 and 10.4.0, which now restrict pagination to the same origin. The previous behavior can be re-enabled via the RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN option.

Affected products

  • Renovate Renovate before 44.11.2
  • Mend Renovate CE before 15.4.0
  • Mend Renovate EE Server before 15.4.0
  • Mend Renovate EE Worker before 15.4.0
  • Mend mend-renovate-enterprise-edition before 10.4.0

Timeline

  • 2026-08-27: disclosed: Security advisory GHSA-rh7w-ccch-gh49 published
  • 2026-09-10: patched: Renovate 44.11.2, Mend CE/EE 15.4.0, and mend-renovate-enterprise-edition 10.4.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.