CVE-2026-88884: Renovate digest update bypass of minimumReleaseAge

CVE-2026-88884 · Severity: medium · CVSS 5.8 · Published 2026-09-10

Renovate is a tool that automatically updates project dependencies. It includes a safety feature called "Minimum Release Age" that prevents pulling in newly published (and potentially malicious) dependencies until they've been available for a certain period. This vulnerability allows digest-type updates (such as Docker images and GitHub Actions) to bypass this safety check, allowing a malicious dependency to trigger CI workflows before the configured waiting period has passed.

Technologies: mend-renovate-ce Helm Chart, mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE, Mend Renovate-Ce. Vendors: Mend.

Quick answers

Is CVE-2026-88884 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88884 being exploited in the wild.
How severe is CVE-2026-88884?
Medium severity, with a CVSS score of 5.8, published 10 September 2026.
Which products and versions are affected?
mend-renovate-ce Helm Chart before 15.4.0; mend-renovate-enterprise-edition Helm Chart before 10.4.0; Mend Renovate EE before 15.4.0; Mend Renovate-Ce before 15.4.0.
Is there a fix for CVE-2026-88884?
A patch was published on 2026-09-10: Renovate 44.3.1, Mend Renovate CE/EE 15.4.0, Mend Enterprise Edition Helm chart 10.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-88884 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-88884?
Check whether you run mend-renovate-ce Helm Chart, mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-863) in the internal minimumReleaseAge validation logic. Renovate fails to apply stability-age checks to digest-type updates (GitHub Actions pinned via commit SHA with floating tags, Docker images, Go modules, and NuGet packages), even when minimumReleaseAge is configured. An attacker can publish a malicious digest and Renovate will immediately create a PR with only a pending renovate/stability-days check, allowing CI to run before the minimum release age has elapsed. This requires the repository to have minimumReleaseAge configured and dependencies with updateType=digest. The issue is fixed in Renovate 44.3.1, Mend Renovate CE/EE 15.4.0, and Mend Enterprise Edition Helm chart 10.4.0.

Affected products

  • Renovate Renovate before 44.3.1
  • Mend Renovate CE before 15.4.0
  • Mend Renovate EE before 15.4.0
  • Mend mend-renovate-ce Helm chart before 15.4.0
  • Mend mend-renovate-enterprise-edition Helm chart before 10.4.0

Timeline

  • 2026-08-27: disclosed
  • 2026-09-10: advisory
  • 2026-09-10: patched: Renovate 44.3.1, Mend Renovate CE/EE 15.4.0, Mend Enterprise Edition Helm chart 10.4.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.