# CVE-2026-88884: Renovate digest update bypass of minimumReleaseAge

Source: https://junglewise.ai/threats/cve-2026-88884-renovate-digest-update-bypass-of-minimumreleaseage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88884 · Severity: medium · CVSS 5.8 · Published 2026-09-10

Renovate is a tool that automatically updates project dependencies. It includes a safety feature called "Minimum Release Age" that prevents pulling in newly published (and potentially malicious) dependencies until they've been available for a certain period. This vulnerability allows digest-type updates (such as Docker images and GitHub Actions) to bypass this safety check, allowing a malicious dependency to trigger CI workflows before the configured waiting period has passed.

Technologies: [mend-renovate-ce Helm Chart](https://junglewise.ai/threats/technologies/mend-renovate-ce-helm-chart), [mend-renovate-enterprise-edition Helm Chart](https://junglewise.ai/threats/technologies/mend-renovate-enterprise-edition-helm-chart), [Mend Renovate EE](https://junglewise.ai/threats/technologies/renovate-ee), [Mend Renovate-Ce](https://junglewise.ai/threats/technologies/renovate-ce). Vendors: [Mend](https://junglewise.ai/threats/vendors/mend).

## Quick answers

**Is CVE-2026-88884 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88884 being exploited in the wild.

**How severe is CVE-2026-88884?** Medium severity, with a CVSS score of 5.8, published 10 September 2026.

**Which products and versions are affected?** mend-renovate-ce Helm Chart before 15.4.0; mend-renovate-enterprise-edition Helm Chart before 10.4.0; Mend Renovate EE before 15.4.0; Mend Renovate-Ce before 15.4.0.

**Is there a fix for CVE-2026-88884?** A patch was published on 2026-09-10: Renovate 44.3.1, Mend Renovate CE/EE 15.4.0, Mend Enterprise Edition Helm chart 10.4.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88884 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-88884?** Check whether you run mend-renovate-ce Helm Chart, mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass (CWE-863) in the internal minimumReleaseAge validation logic. Renovate fails to apply stability-age checks to digest-type updates (GitHub Actions pinned via commit SHA with floating tags, Docker images, Go modules, and NuGet packages), even when minimumReleaseAge is configured. An attacker can publish a malicious digest and Renovate will immediately create a PR with only a pending renovate/stability-days check, allowing CI to run before the minimum release age has elapsed. This requires the repository to have minimumReleaseAge configured and dependencies with updateType=digest. The issue is fixed in Renovate 44.3.1, Mend Renovate CE/EE 15.4.0, and Mend Enterprise Edition Helm chart 10.4.0.

## Affected products

- Renovate Renovate before 44.3.1
- Mend Renovate CE before 15.4.0
- Mend Renovate EE before 15.4.0
- Mend mend-renovate-ce Helm chart before 15.4.0
- Mend mend-renovate-enterprise-edition Helm chart before 10.4.0

## Timeline

- 2026-08-27: disclosed
- 2026-09-10: advisory
- 2026-09-10: patched: Renovate 44.3.1, Mend Renovate CE/EE 15.4.0, Mend Enterprise Edition Helm chart 10.4.0

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-g4qr-hw2h-687r](https://github.com/renovatebot/renovate/security/advisories/GHSA-g4qr-hw2h-687r)
- [https://www.vulncheck.com/advisories/renovate-before-44.3.1-authentication-bypass-via-digest-updates](https://www.vulncheck.com/advisories/renovate-before-44.3.1-authentication-bypass-via-digest-updates)

## Related threats

- [Renovate server-side request forgery in HTTP presets](https://junglewise.ai/threats/cve-2026-110868-renovate-before-44-79-0-contains-a-server-side-request-forgery)
- [Renovate environment variable allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110867-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate protection mechanism bypass in minimumReleaseAge checks](https://junglewise.ai/threats/cve-2026-110866-renovate-before-44-61-3-contains-a-protection-mechanism-bypass)
- [Renovate HTTP header allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110865-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate command injection in Maven Wrapper manager](https://junglewise.ai/threats/cve-2026-88889-renovate-command-injection-in-maven-wrapper-manager)