CVE-2026-88882
Renovate, a tool that automates dependency updates, had a flaw that let it send registry credentials to attacker‑controlled servers when following pagination links from a NuGet registry. The issue existed in versions before 44.11.2 and is fixed in newer releases by restricting pagination to the same origin.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Renovate versions before 44.11.2, including Mend Renovate CE/EE images and charts before 15.4.0, and mend‑renovate‑enterprise‑edition Helm chart before 10.4.0.
Real-world impact
An attacker controlling or compromising a NuGet registry could receive the credentials that Renovate uses to access the registry, potentially allowing them to access private packages or other resources.
Why this severity
The CVSS score of 9.2 reflects the high impact of credential exposure, the ease of exploitation over the network, and the lack of authentication or user interaction required.
What to do about it
- 01Upgrade Renovate to version 44.11.2 or later.
- 02Restart the Renovate service to apply the update.
NVD description
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.