CVE-2026-88882 Renovate before 44.11.2 Credential Exfiltration via Link Header
A malicious NuGet registry can exfiltrate credentials by directing Renovate to an attacker-controlled server via the Link header during pagination.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88882?
CVE-2026-88882 is a critical server-side request forgery vulnerability in mend-renovate-ce, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0), when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by the registry in the HTTP `Link` header without verifying that the target has the same origin as the configured registry. Registry credentials are attached to the request for the 'next' page, so a malicious or compromised NuGet registry can return a `Link` header pointing at an attacker-controlled server and cause Renovate to send the registry credentials to that server. Exploitation requires the remote registry to be malicious or compromised; such a registry would normally already have received the credentials on the initial request, so the issue primarily allows the credentials to be delivered to an additional, attacker-chosen host. The fix restricts pagination to the same origin; the previous behaviour can be re-enabled with the RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN option.
Weakness: CWE-601
Which versions are affected by CVE-2026-88882?
How do I fix CVE-2026-88882?
No fix has been published for CVE-2026-88882 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-88882 being exploited?
There is no known exploitation of CVE-2026-88882 in the wild and no public exploit code.
Sources
Also known as GHSA-978f-wwpx-5hh6, GHSA-rh7w-ccch-gh49.