CVE-2026-88882

CVE-2026-88882 is a credential-disclosure flaw in the Renovate dependency-update automation tool: when listing new package versions from a NuGet registry, Renovate follows 'next'-page pagination URLs taken from the HTTP Link header without verifying that the target shares the origin of the configured registry. A malicious or compromised NuGet registry can therefore return a Link header pointing at an attacker-controlled server, and Renovate will send that registry's credentials along with the request for the 'next' page, delivering the credentials to the attacker's chosen host. Because exploitation requires the registry itself to already be malicious or compromised (and it would normally have received the credentials on the initial request anyway), the practical gain is that credentials reach an additional attacker-controlled host, where reuse could expose private package feeds or other systems; CVSS 4.0 scores this 9.2 (critical) with high impact on the confidentiality of the vulnerable system and subsequent systems. Affected are all Renovate releases before 44.11.2, Mend Renovate CE/EE images and charts before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, in configurations that query NuGet registries with credentials. No public proof of concept is known, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and there are no reports of in-the-wild exploitation.

What to do: Upgrade to Renovate 44.11.2 or later, Mend Renovate CE/EE images and charts 15.4.0 or later, and the mend-renovate-enterprise-edition chart 10.4.0 or later; the fix restricts NuGet pagination to the registry's own origin, and the RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN option can restore the previous behavior where needed. If any configured NuGet registry was third-party hosted or could have been compromised, treat that feed's stored credentials or tokens as potentially disclosed to attacker-chosen hosts and rotate them, and check proxy/web logs for unexpected cross-origin requests following NuGet feed queries.