Credential Exposure in Renovate Dependency Update Tool by Mend

CVE-2026-88887

What is CVE-2026-88887?

The Renovate tool, primarily used for dependency updates, is susceptible to credential exposure via HTTP Link headers during pagination requests. When Renovate interacts with a container registry, it blindly follows Link headers without validating the source. An attacker controlling a malicious registry can exploit this by directing Renovate to send its authentication credentials to an external, unauthorized host. This vulnerability underscores the importance of implementing strict origin checks for link navigation, especially in environments reliant on container dependencies.

References