Executive brief
Renovate is an automated tool that manages software library updates. When configured to use mutual TLS authentication, the tool was logging TLS private keys in plaintext to its logs if the keys appeared in configuration fields other than the expected one. An attacker with read access to Renovate logs could recover these private keys and impersonate the affected services, potentially gaining access to sensitive systems and data.
Technical details
This is an information disclosure vulnerability (CWE-532) in Renovate's log sanitization logic. The vulnerable component is the configuration logging system which redacts hostRules[].httpsPrivateKey only when it appears under that specific key name, but fails to redact the same secret value if it appears elsewhere in logs or configuration (e.g., in other field names or configuration options). The vulnerability requires network access to Renovate's logging output and low privileges (ability to read logs), with no user interaction needed. An attacker can extract TLS private keys used for mutual TLS authentication and use them to impersonate the service or access protected endpoints. The issue is fixed in Renovate 44.14.4 and Mend Renovate CE/EE 15.4.0, which implement comprehensive redaction of httpsPrivateKey, httpsCertificate, and httpsCertificateAuthority values wherever they appear in logs.
Affected products
- Renovate Renovate before 44.14.4
- Mend Renovate CE before 15.4.0
- Mend Renovate EE before 15.4.0
- Mend mend-renovate-enterprise-edition Helm chart before 10.4.0
Timeline
- 2026-09-10: disclosed: Vulnerability published; CVE-2026-88883 assigned
- 2026-09-10: patched: Renovate 44.14.4, Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0 released with fix