GPU VulnDB

Database/Control plane, storage & DevOps

Renovate: unvalidated GitHub Link header sends host credentials to an attacker-controlled server

CVSS 9.2CVE-2026-88881Control plane, storage & DevOpscurated

Impact

Renovate follows the next URL from a GitHub server's HTTP Link header without checking it still points at the host it originally contacted, and sends that host's configured credentials along. A malicious or compromised GitHub.com, GitHub Enterprise Cloud or Enterprise Server endpoint - reached as the repository host or merely as a datasource such as github-releases, github-tags or git-refs - can return a Link header pointing anywhere and collect the token. In a fleet's CI/CD path Renovate typically holds a token with write access to the infrastructure repositories that define node images, driver versions, Helm charts and GPU operator manifests, so a leaked token is a route to changing what gets deployed on the nodes rather than just a read of source. Exploitation requires the GitHub server in question to already be malicious or compromised, which is the main limiter.

Who can reach it

Remote and unauthenticated from the attacker's side, but it requires control of a GitHub server Renovate talks to - either its repository host or any configured github-releases/github-tags/git-refs datasource. No access to the Renovate host itself is needed.

What to do

Upgrade to Renovate 44.11.3 (npm package and renovate/renovate container images), Mend Renovate CE/EE images, mend-renovate-ce Helm chart 15.4.0, or mend-renovate-enterprise-edition Helm chart 10.4.0. That is a bot/job image bump and redeploy, with no impact on GPU nodes. The advisory states there is no workaround, and warns that the pre-existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check - use it only for servers that deliberately paginate across hosts. Rotate any GitHub tokens Renovate used against a server you do not fully trust.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-88881https://github.com/renovatebot/renovate/security/advisories/GHSA-w57v-h33h-835chttps://www.vulncheck.com/advisories/renovate-before-44.11.3-credential-exfiltration-via-link-header-2

Related entries

All Control plane, storage & DevOps entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.