External risk intelligence

Renovate Credential Exfiltration Via Link Header Redirection

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-88880

Renovate is a developer-focused dependency automation tool typically run within internal CI/CD pipelines or as a local client-side utility. It is not designed to be an internet-facing service, appliance, or gateway, and its interaction with external servers is a client-side function rather than a public-facing service architecture.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Renovate, a tool that automates dependency updates. The issue allows malicious servers to trick Renovate into sending authentication credentials, potentially leading to unauthorized access or data exposure. The main concern is confirming if your organization uses this specific tool and if it could be exposed to malicious servers.

Malicious servers can steal login credentials.
Protects automated software update processes.
Confirm use and assess external exposure.

Attack Path

How an attacker could exploit the issue

An attacker could compromise a GitLab server to redirect requests containing user credentials to their own infrastructure. This occurs when the Renovate tool follows GitLab's server pagination links without properly validating the destination, leading to sensitive information leakage.

Requires control over a GitLab server.
Triggers when Renovate follows a malicious Link header.
Risk of authentication credential exfiltration.

Live Threat

Current exploitation, exposure, and threat context

When Renovate, a dependency automation tool, follows GitLab server pagination, a malicious server could trick it into redirecting credential-bearing requests. This could lead to authentication credentials being sent to an attacker-controlled server.

Authentication credentials could be exposed.
Malicious servers could redirect requests.
Credentials may be exfiltrated.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Renovate could allow attackers controlling a compromised GitLab server to exfiltrate authentication credentials by manipulating Link header destinations. The first practical step is to identify where Renovate is deployed, confirm its reachability and criticality, and identify the accountable owner for remediation planning.

Application owners or DevOps teams own the issue.
Verify Renovate's deployment and GitLab server interaction.
Plan remediation based on exposure and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Renovate?

Renovate is an automated dependency management tool that developers use to keep software projects up to date. It scans source code repositories to identify outdated libraries and automatically creates pull requests to apply updates. By automating this process, it helps teams reduce technical debt and maintain security across their development lifecycle.

What does CVE-2026-88880 mean?

This vulnerability is classified as CWE-601: URL Redirection to Untrusted Site (Open Redirect). In this specific case, Renovate fails to verify the destination when following pagination links from a GitLab server. Because it trusts the server's instructions without validation, a compromised GitLab server can force Renovate to send your sensitive authentication credentials to an attacker-controlled address instead of the intended target.

How can an attacker trigger this vulnerability?

An attacker must gain control over a GitLab server that Renovate is configured to interact with. The bug is triggered when Renovate attempts to follow pagination links provided by that server during its routine dependency checks. Note that simply running Renovate against a legitimate, secure server does not trigger the bug; it specifically requires a malicious or compromised server to send the crafted redirect instructions.

How relevant is this CVE to my environment?

According to Halo Surface Signal, this vulnerability is considered 'Very unlikely' to be exploited in most environments. Renovate is typically used as a client-side utility or within internal CI/CD pipelines rather than as an internet-facing service. Therefore, your primary concern is whether your internal Renovate instances are configured to communicate with any third-party or untrusted GitLab servers.

What should I do to address this issue?

The most important first step is to locate all instances of Renovate running in your environment. Once identified, verify if those instances connect to GitLab repositories. Reach out to the DevOps teams responsible for these configurations to determine if they are using an affected version and prioritize updating to version 44.11.3 or later to ensure proper link validation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.