CVE-2026-88881

Renovate, a dependency update tool, follows the 'next' page URLs that a GitHub server supplies in HTTP Link headers when paginating responses from GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server (including when GitHub is used as a datasource such as github-releases, github-tags, or git-refs), and sends the credentials configured for that host to whatever URL the server names. Because the 'next' URL is not validated against the host originally contacted, a malicious or compromised GitHub server can point the Link header at an attacker-controlled host and capture the credentials Renovate sends. An attacker who obtains these credentials gains access to whatever repositories and permissions the configured GitHub token carries, since the token is disclosed to the attacker's server. Anyone running self-hosted Renovate (npm package or renovate/renovate container image) or Mend Renovate CE/EE against a GitHub endpoint that is already malicious or compromised is affected. No public proof-of-concept is known, the issue is not in CISA's KEV, and fixed releases are renovate 44.11.3, the mend-renovate-ce Helm chart 15.4.0, and the mend-renovate-enterprise-edition Helm chart 10.4.0.

What to do: Upgrade Renovate to 44.11.3 (npm package or renovate/renovate container image); Mend customers should move to Mend Renovate CE/EE images paired with mend-renovate-ce Helm chart 15.4.0 and mend-renovate-enterprise-edition Helm chart 10.4.0. There is no workaround, so avoid using the RENOVATE_X_REBASE_PAGINATION_LINKS option (which disables the new host check) unless your GitHub server intentionally paginates to different hosts, and review GitHub audit/token logs for any credential use from unexpected hosts as a precaution.