CVE-2026-88881

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.11.3 mend-renovate-ce helm chart versions prior to 15.4.0 mend-renovate-enterprise-edition helm chart versions prior to 10.4.0

Description When interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, the tool follows pagination links provided in the HTTP Link header and sends configured credentials to the URL specified as the next page. Since the pagination URL is not validated against the original host, a compromised or malicious GitHub server can return a Link header pointing to an attacker-controlled host, leading to the disclosure of credentials. This requires the GitHub server acting as the repository host or a datasource (such as github-releases, github-tags, or git-refs) to be already compromised.

Recommendations Update Renovate to version 44.11.3. Update mend-renovate-ce helm chart to version 15.4.0. Update mend-renovate-enterprise-edition helm chart to version 10.4.0.