CVE-2026-88881

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP `Link` header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Because the pagination URL is not validated against the host originally contacted, a malicious or compromised GitHub server can return a `Link` header pointing to an attacker-controlled host and cause Renovate to disclose those credentials to it. Exploitation requires that the GitHub server Renovate talks to (as the repository host or as a datasource such as github-releases, github-tags, or git-refs) is already malicious or compromised. The issue is fixed in renovate 44.11.3 (npm and renovate/renovate container images), Mend Renovate CE/EE images and the mend-renovate-ce helm chart 15.4.0, and the mend-renovate-enterprise-edition helm chart 10.4.0. There is no workaround; the pre-existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check and should only be used with servers that intentionally use different pagination hosts.

• CWE-601

• https://github.com/renovatebot/renovate/security/advisories/GHSA-w57v-h33h-835c
• https://www.vulncheck.com/advisories/renovate-before-44.11.3-credential-exfiltration-via-link-header-2

Published

Sep 10, 2026

Last Modified

Sep 15, 2026

Status

Undergoing Analysis

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88876AVideo through revision c3edcc274c389816d434acadac07ee78eaf3…7.5
• CVE-2026-88877Traefik is a HTTP reverse proxy and load balancer. In versio…9.8
• CVE-2026-88878Traefik is an HTTP reverse proxy and load balancer. In versi…5.3
• CVE-2026-88879Traefik is an HTTP reverse proxy and load balancer. In Traef…8.2
• CVE-2026-8888Version 3.0.7 of the Securly Chrome Extension downloads conf…7.5
• CVE-2026-88880Renovate before 44.11.3 fails to validate Link header destin…8.6
• CVE-2026-88882Renovate is a dependency update automation tool. In versions…8.6
• CVE-2026-88883Renovate is an automated dependency update tool. In versions…7.7
• CVE-2026-88884Renovate is a dependency update automation tool. In versions…5.8
• CVE-2026-88885Renovate before 44.14.7 contains a command injection vulnera…7
• CVE-2026-88886Renovate is a dependency update automation tool. In versions…7.8
• CVE-2026-88887Renovate is a dependency update automation tool. When listin…8.6