# CVE-2026-88887: Renovate credential exfiltration via Docker Link header

Source: https://junglewise.ai/threats/cve-2026-88887-renovate-credential-exfiltration-via-docker-link-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88887 · Severity: high · CVSS 8.6 · Published 2026-09-10

Renovate is a tool that automatically updates dependencies in software projects, including container images. When fetching container image metadata from a registry, Renovate can be tricked by a malicious or compromised registry into sending authentication credentials to an attacker-controlled server. An attacker with control of a container registry used by the target organization could steal credentials in a single request.

Technologies: [mend-renovate-enterprise-edition Helm Chart](https://junglewise.ai/threats/technologies/mend-renovate-enterprise-edition-helm-chart), [Mend Renovate EE](https://junglewise.ai/threats/technologies/renovate-ee), [Mend Renovate-Ce](https://junglewise.ai/threats/technologies/renovate-ce). Vendors: [Mend](https://junglewise.ai/threats/vendors/mend).

## Quick answers

**Is CVE-2026-88887 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88887 being exploited in the wild.

**How severe is CVE-2026-88887?** High severity, with a CVSS score of 8.6, published 10 September 2026.

**Which products and versions are affected?** mend-renovate-enterprise-edition Helm Chart < 10.4.0; Mend Renovate EE < 15.4.0; Mend Renovate-Ce < 15.4.0.

**Is there a fix for CVE-2026-88887?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88887 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88887?** Check whether you run mend-renovate-enterprise-edition Helm Chart, Mend Renovate EE or Mend Renovate-Ce at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Renovate follows HTTP Link header pagination when listing container image tags and digests from a registry, but fails to validate that pagination URLs share the same origin as the original registry endpoint. This allows a malicious or compromised container registry to inject a Link header pointing to an attacker-controlled host. When Renovate requests the next page, it attaches the same registry credentials (authentication tokens) to the cross-origin request, enabling credential exfiltration. The vulnerability is a same-origin policy bypass (CWE-601). Exploitation requires the target to have container (Docker) image dependencies and to be actively interacting with a malicious or compromised registry. The issue is patched in Renovate 44.11.2 (npm/npm and renovate/renovate Docker images), Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0. A workaround flag (RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN) exists but should only be used when intentional cross-origin pagination is required.

## Affected products

- Renovate Renovate < 44.11.2
- Mend Renovate CE < 15.4.0
- Mend Renovate EE < 15.4.0
- Mend mend-renovate-enterprise-edition Helm Chart < 10.4.0

## Timeline

- 2026-08-27: disclosed
- 2026-09-10: advisory

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-v73q-hvqx-hxwx](https://github.com/renovatebot/renovate/security/advisories/GHSA-v73q-hvqx-hxwx)
- [https://www.vulncheck.com/advisories/renovate-before-44.11.2-credential-exfiltration-via-link-header-2](https://www.vulncheck.com/advisories/renovate-before-44.11.2-credential-exfiltration-via-link-header-2)

## Related threats

- [Renovate server-side request forgery in HTTP presets](https://junglewise.ai/threats/cve-2026-110868-renovate-before-44-79-0-contains-a-server-side-request-forgery)
- [Renovate environment variable allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110867-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate protection mechanism bypass in minimumReleaseAge checks](https://junglewise.ai/threats/cve-2026-110866-renovate-before-44-61-3-contains-a-protection-mechanism-bypass)
- [Renovate HTTP header allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110865-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate command injection in Maven Wrapper manager](https://junglewise.ai/threats/cve-2026-88889-renovate-command-injection-in-maven-wrapper-manager)