CVE-2026-88884

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.3.1 Mend Renovate CE/EE images versions prior to 15.4.0 mend-renovate-ce Helm chart versions prior to 15.4.0 mend-renovate-enterprise-edition Helm chart versions prior to 10.4.0

Description Digest updates are not subject to internal minimumReleaseAge stability age checks. When a repository uses minimumReleaseAge and has dependencies with updateType=digest (such as Docker images, Go modules, NuGet packages, or GitHub Actions pinned to a commit SHA with a floating tag), the tool may open a pull request for a newly published digest. This allows potentially malicious dependency versions to trigger pull requests and CI workflows before the configured minimum release age has elapsed.

Recommendations Update Renovate to version 44.3.1. Update Mend Renovate CE/EE images to version 15.4.0. Update mend-renovate-ce Helm chart to version 15.4.0. Update mend-renovate-enterprise-edition Helm chart to version 10.4.0. As a temporary workaround, disable digest updates or gate them behind dependencyDashboardApproval.