CVE-2026-88887
Renovate, a tool that automatically updates dependencies, can leak registry credentials when it follows pagination links from a container registry. The tool attaches its credentials to any follow‑up request without checking that the link points to the same registry, allowing a malicious registry to steal those credentials. This flaw is fixed in newer releases of Renovate and Mend Renovate.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users of Renovate before version 44.11.2, Mend Renovate CE/EE before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0. Typical users are developers who rely on Renovate to manage container image dependencies.
Real-world impact
An attacker controlling or compromising a container registry can obtain the credentials that Renovate uses to pull images. With those credentials, the attacker could access private images, potentially exfiltrate data or deploy malicious containers.
Why this severity
The CVSS score of 9.2 reflects the high confidentiality impact (credentials are exposed), no authentication or user interaction is required, and the vulnerability is exploitable over the network. The score is high because the attacker can gain privileged access to private registries, which is a critical business risk.
What to do about it
- 01Upgrade Renovate to version 44.11.2 or later (npm and renovate/renovate images).
- 02Upgrade Mend Renovate CE/EE to version 15.4.0 or later.
- 03Upgrade mend-renovate-enterprise-edition Helm chart to version 10.4.0 or later.
NVD-referenced vendor advisory
Timeline
- Sep 10, 2026 · 3d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 10, 2026 · 3d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.