PT-2026-78371 · Renovate+1 · Renovate+1
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Renovate versions 19.180.0 through 23.25.0
Description
When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the
http.extraheader=AUTHORIZATION parameter is logged without redaction, allowing anyone with access to the saved logs to obtain the bot credentials.Recommendations
Update to version 23.25.1.
Revoke and regenerate credentials if logs may have been exposed.
Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Azure Devops
Renovate