CVE-2026-88883: Renovate TLS private key log sanitisation bypass

CVE-2026-88883 · Severity: high · CVSS 7.7 · Published 2026-09-10

Renovate is an automated tool that manages software library updates. When configured to use mutual TLS authentication, the tool was logging TLS private keys in plaintext to its logs if the keys appeared in configuration fields other than the expected one. An attacker with read access to Renovate logs could recover these private keys and impersonate the affected services, potentially gaining access to sensitive systems and data.

Technologies: mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE, Mend Renovate-Ce. Vendors: Mend.

Quick answers

Is CVE-2026-88883 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88883 being exploited in the wild.
How severe is CVE-2026-88883?
High severity, with a CVSS score of 7.7, published 10 September 2026.
Which products and versions are affected?
mend-renovate-enterprise-edition Helm Chart before 10.4.0; Mend Renovate EE before 15.4.0; Mend Renovate-Ce before 15.4.0.
Is there a fix for CVE-2026-88883?
A patch was published on 2026-09-10: Renovate 44.14.4, Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88883 attacked?
It is attacked over the network.
Am I affected by CVE-2026-88883?
Check whether you run mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE or Mend Renovate-Ce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an information disclosure vulnerability (CWE-532) in Renovate's log sanitization logic. The vulnerable component is the configuration logging system which redacts hostRules[].httpsPrivateKey only when it appears under that specific key name, but fails to redact the same secret value if it appears elsewhere in logs or configuration (e.g., in other field names or configuration options). The vulnerability requires network access to Renovate's logging output and low privileges (ability to read logs), with no user interaction needed. An attacker can extract TLS private keys used for mutual TLS authentication and use them to impersonate the service or access protected endpoints. The issue is fixed in Renovate 44.14.4 and Mend Renovate CE/EE 15.4.0, which implement comprehensive redaction of httpsPrivateKey, httpsCertificate, and httpsCertificateAuthority values wherever they appear in logs.

Affected products

  • Renovate Renovate before 44.14.4
  • Mend Renovate CE before 15.4.0
  • Mend Renovate EE before 15.4.0
  • Mend mend-renovate-enterprise-edition Helm chart before 10.4.0

Timeline

  • 2026-09-10: disclosed: Vulnerability published; CVE-2026-88883 assigned
  • 2026-09-10: patched: Renovate 44.14.4, Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.