CVE-2026-88883

Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0), log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of hostRules[].httpsPrivateKey was redacted in the field itself, the same private key value was not redacted if it also appeared elsewhere — for example in another configuration option or in a log message under a key other than httpsPrivateKey — causing the full private key to be written to Renovate's logs in cleartext. This affects deployments that configure Mutual TLS through hostRules[].httpsPrivateKey without passing the value through the documented `secrets` configuration. Anyone able to read the resulting logs can recover the private key. The issue is fixed in Renovate 44.14.4, which redacts any value supplied as hostRules[].httpsPrivateKey wherever it appears in the logs; as a workaround, supply the key via the `secrets` configuration.

• CWE-532

• https://github.com/renovatebot/renovate/security/advisories/GHSA-4hmw-qw74-vrhm
• https://www.vulncheck.com/advisories/renovate-before-44.14.4-tls-private-key-log-sanitisation

Published

Sep 10, 2026

Last Modified

Sep 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-88878Traefik is an HTTP reverse proxy and load balancer. In versi…5.3
• CVE-2026-88879Traefik is an HTTP reverse proxy and load balancer. In Traef…8.2
• CVE-2026-8888Version 3.0.7 of the Securly Chrome Extension downloads conf…7.5
• CVE-2026-88880Renovate before 44.11.3 fails to validate Link header destin…8.6
• CVE-2026-88881Renovate, a dependency update tool, follows pagination links…8.6
• CVE-2026-88882Renovate is a dependency update automation tool. In versions…8.6
• CVE-2026-88884Renovate is a dependency update automation tool. In versions…5.8
• CVE-2026-88885Renovate before 44.14.7 contains a command injection vulnera…7
• CVE-2026-88886Renovate is a dependency update automation tool. In versions…7.8
• CVE-2026-88887Renovate is a dependency update automation tool. When listin…8.6
• CVE-2026-88888Renovate before 44.14.7 contains a command injection vulnera…7
• CVE-2026-88889Renovate before 44.14.7 contains a command injection vulnera…7.8