CVE-2026-88887

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.11.2 Mend Renovate CE/EE versions prior to 15.4.0 mend-renovate-enterprise-edition Helm chart versions prior to 10.4.0

Description When listing tags or digests for a container image, the tool follows pagination links provided by the remote registry in the HTTP Link header. It attaches registry credentials to the subsequent request without verifying if the pagination URL shares the same origin as the original registry. A compromised or malicious registry could provide a Link header pointing to an attacker-controlled host, allowing the attacker to capture the credentials used for that registry. This issue affects targets with container dependencies that interact with a malicious registry.

Recommendations Update Renovate to version 44.11.2. Update Mend Renovate CE/EE to version 15.4.0. Update mend-renovate-enterprise-edition Helm chart to version 10.4.0.