CVE-2026-88887: Renovate credential exfiltration via Docker Link header

CVE-2026-88887 · Severity: high · CVSS 8.6 · Published 2026-09-10

Renovate is a tool that automatically updates dependencies in software projects, including container images. When fetching container image metadata from a registry, Renovate can be tricked by a malicious or compromised registry into sending authentication credentials to an attacker-controlled server. An attacker with control of a container registry used by the target organization could steal credentials in a single request.

Technologies: mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE, Mend Renovate-Ce. Vendors: Mend.

Quick answers

Is CVE-2026-88887 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-88887 being exploited in the wild.
How severe is CVE-2026-88887?
High severity, with a CVSS score of 8.6, published 10 September 2026.
Which products and versions are affected?
mend-renovate-enterprise-edition Helm Chart < 10.4.0; Mend Renovate EE < 15.4.0; Mend Renovate-Ce < 15.4.0.
Is there a fix for CVE-2026-88887?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88887 attacked?
It is attacked over the network.
Am I affected by CVE-2026-88887?
Check whether you run mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE or Mend Renovate-Ce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Renovate follows HTTP Link header pagination when listing container image tags and digests from a registry, but fails to validate that pagination URLs share the same origin as the original registry endpoint. This allows a malicious or compromised container registry to inject a Link header pointing to an attacker-controlled host. When Renovate requests the next page, it attaches the same registry credentials (authentication tokens) to the cross-origin request, enabling credential exfiltration. The vulnerability is a same-origin policy bypass (CWE-601). Exploitation requires the target to have container (Docker) image dependencies and to be actively interacting with a malicious or compromised registry. The issue is patched in Renovate 44.11.2 (npm/npm and renovate/renovate Docker images), Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0. A workaround flag (RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN) exists but should only be used when intentional cross-origin pagination is required.

Affected products

  • Renovate Renovate < 44.11.2
  • Mend Renovate CE < 15.4.0
  • Mend Renovate EE < 15.4.0
  • Mend mend-renovate-enterprise-edition Helm Chart < 10.4.0

Timeline

  • 2026-08-27: disclosed
  • 2026-09-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.