CVE-2026-88880

HighCVSS 8.6/10Last modified Sep 29, 2026

Description

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-601

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
renovatebot	renovate	< 44.11.3
mend	renovate-ce	< 15.4.0
mend	renovate-ee-server	< 15.4.0
mend	renovate-ee-worker	< 15.4.0
mend	mend-renovate-ce	< 15.4.0
mend	mend-renovate-enterprise-edition	< 10.4.0

References

Timeline

Published: Sep 10, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-888818.6Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with G CVE-2026-888828.6Renovate is a dependency update automation tool. In versions before 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and me CVE-2026-888837.7Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renov CVE-2026-888845.8Renovate is a dependency update automation tool. In versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce H CVE-2026-888857.0Renovate before 44.14.7 contains a command injection vulnerability in the gomod manager when processing unescaped depName parameters in impo CVE-2026-888867.8Renovate is a dependency update automation tool. In versions before 44.14.7 (and in Mend Renovate CE/EE distributions before 15.4.0, and the CVE-2026-888878.6Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied CVE-2026-888887.0Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped or CVE-2026-888897.8Renovate before 44.14.7 contains a command injection vulnerability in the Maven Wrapper manager that allows attackers to execute arbitrary c CVE-2026-88897.5Version 3.0.7 of the Securly Chrome Extension uses deprecated SHA-1 hashing for IWF CSAM URL matching (25,020 hashes) and CIPA blocklist mat CVE-2026-888908.5OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter colu CVE-2026-888918.3OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modi