CVE-2026-88883

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.14.4 Mend Renovate CE/EE images versions prior to 15.4.0 mend-renovate-enterprise-edition Helm chart versions prior to 10.4.0

Description Log sanitization for TLS private keys used for Mutual TLS (a process where both client and server authenticate each other using certificates) was incomplete. While the value of the hostRules[].httpsPrivateKey variable was redacted in its own field, the same private key value remained unredacted if it appeared in other configuration options or log messages under different keys. This results in the full private key being written to logs in cleartext, allowing anyone with log access to recover it. This issue specifically affects deployments that configure Mutual TLS via hostRules[].httpsPrivateKey instead of using the secrets configuration.

Recommendations Update Renovate to version 44.14.4 or later. Update Mend Renovate CE/EE images to version 15.4.0 or later. Update mend-renovate-enterprise-edition Helm chart to version 10.4.0 or later. As a temporary workaround, supply the private key via the secrets configuration.