Insufficient Log Sanitization in Renovate Dependency Update Tool

CVE-2026-88883

What is CVE-2026-88883?

Renovate, an automated dependency update tool, suffers from a log sanitization flaw where TLS private keys, specifically hostRules[].httpsPrivateKey, can be exposed in logs if not properly managed. While the key is redacted in its designated field, it may still appear in plain text elsewhere in the logs under different configuration options. This oversight could allow unauthorized access to sensitive private key information, particularly in environments utilizing Mutual TLS. Users are urged to upgrade to Renovate version 44.14.4 or later, which addresses this issue, or utilize the secrets configuration for safeguarding private keys.

References