Cross-Origin Credential Exposure in Renovate Dependency Update Tool

CVE-2026-88882

What is CVE-2026-88882?

Renovate, an automation tool for dependency updates, has a vulnerability wherein it fails to properly verify pagination URLs returned from a NuGet registry. This weakness allows malicious entities to exploit the HTTP 'Link' header, leading to potential credential exposure. When Renovate follows these URLs to retrieve additional package versions, it inadvertently sends sensitive registry credentials to an attacker-controlled server. Although exploitation requires a compromised or malicious NuGet registry, this security flaw enhances the risk of credential leakage to unauthorized hosts. A patch is available that restricts pagination navigation to the same origin, thus securing the process.

References