CVE-2026-88883

Renovate, an automated dependency update tool, incompletely sanitized logs for TLS private keys used for Mutual TLS: while the value in hostRules[].httpsPrivateKey was redacted in that field, the same key value written anywhere else in the logs (e.g., under another configuration option or log key) was emitted in cleartext. The flaw is triggered when a deployment configures Mutual TLS via hostRules[].httpsPrivateKey without routing the value through the documented 'secrets' configuration, causing the full private key to be written to Renovate's logs. An attacker who can read those logs recovers the TLS client private key and can use it to impersonate the Renovate deployment against mTLS-protected hosts, such as private package registries (CVSS 4.0 rates high impact on the vulnerable and subsequent systems). Affected deployments are self-hosted Renovate before 44.14.4, Mend Renovate CE/EE images before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0, limited to those using the affected Mutual TLS configuration. The issue is fixed in Renovate 44.14.4 (and matching image/chart releases); there is no CISA KEV listing and no known public proof-of-concept or reported exploitation.

What to do: Upgrade to Renovate 44.14.4 or later, Mend Renovate CE/EE images 15.4.0 or later, and the mend-renovate-enterprise-edition Helm chart 10.4.0 or later. As an interim mitigation, supply the TLS private key through the documented 'secrets' configuration instead of placing the raw value in hostRules[].httpsPrivateKey. Audit existing log stores and restrict log access; rotate any Mutual TLS client keys that may have been written to logs in cleartext.