CVE-2026-88880

Renovate versions before 44.11.3 fail to validate the destinations in HTTP Link headers when following pagination responses from a GitLab API, an open-redirect flaw (CWE-601) rated 9.2 critical under CVSS 4.0. If the GitLab server a Renovate instance is configured against is malicious or has been compromised, the attacker can return a crafted Link header pointing to attacker-controlled infrastructure, causing Renovate to send its follow-on requests — which carry the instance's authentication credentials — to the attacker. The attacker thereby captures Renovate's GitLab tokens, and the score's high subsequent-confidentiality impact reflects that those credentials can grant access to the connected GitLab environment and repositories. Any deployment running an affected version against a GitLab server it does not fully control is affected, with self-hosted Renovate pointed at self-managed GitLab instances being the most realistic scenario. There is currently no known exploitation in the wild, no public proof of concept, and the issue is not on CISA's KEV; it was assigned by VulnCheck.

What to do: Upgrade Renovate to 44.11.3 or later. If an immediate upgrade is not possible, restrict Renovate's egress to trusted GitLab hosts (e.g., via network filtering) and only run it against GitLab servers you trust. Operators of self-managed GitLab servers that may have been compromised should review Renovate logs for unexpected outbound requests to non-GitLab hosts and rotate the GitLab access tokens used by the bot.