CVE-2026-88882

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.11.2 Mend Renovate CE/EE images and charts versions prior to 15.4.0 mend-renovate-enterprise-edition helm chart versions prior to 10.4.0

Description When listing new package versions from a NuGet registry, the software follows pagination URLs provided in the HTTP Link header without verifying if the target shares the same origin as the configured registry. Because registry credentials are included in the request for the next page, a compromised or malicious NuGet registry can redirect these credentials to an attacker-controlled server by providing a malicious Link header. This issue allows credentials to be leaked to an additional host chosen by the attacker, provided the remote registry is already malicious or compromised.

Recommendations Update Renovate to version 44.11.2 or later. Update Mend Renovate CE/EE images and charts to version 15.4.0 or later. Update mend-renovate-enterprise-edition helm chart to version 10.4.0 or later.