CVE-2026-88887

Renovate (a dependency update automation tool) follows pagination URLs supplied by container registries in the HTTP Link header when listing tags/digests, and it attaches the registry's credentials to the follow-up request without verifying that the pagination URL has the same origin as the original registry (CWE-601). A malicious or compromised container registry can therefore return a Link header pointing to an attacker-controlled host while Renovate is enumerating Docker dependencies, causing Renovate to send that registry's credentials to the attacker. An attacker who captures these credentials gains potentially privileged access to the registry account and any other resources those credentials can unlock (CVSS 4.0 rates the confidentiality impact on both the vulnerable and subsequent systems as high, giving a 9.2 critical score). Exploitation requires that the target uses container (Docker) dependencies and is already interacting with the malicious or compromised registry, so only Renovate deployments with container ecosystems are practically exposed. As of this analysis there is no known exploitation, no public proof-of-concept, and the issue is not in the CISA KEV catalog.

What to do: Upgrade self-hosted Renovate (npm and renovate/renovate images) to 44.11.2, Mend Renovate CE/EE to 15.4.0, and the mend-renovate-enterprise-edition Helm chart to 10.4.0, which enforce the same-origin check on pagination links. Note that RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN disables the new same-origin check, so avoid setting it for untrusted registries. As a precaution, audit and rotate registry credentials that were used with any registry you do not fully trust.