PT-2026-78371

CVE-2020-37267

Published

2020-09-14

Updated

2026-08-19

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Renovate versions 19.180.0 through 23.25.0

Description When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the http.extraheader=AUTHORIZATION parameter is logged without redaction, allowing anyone with access to the saved logs to obtain the bot credentials.

Recommendations Update to version 23.25.1. Revoke and regenerate credentials if logs may have been exposed.

Exploitability

Fix

Impacts

Researchers

Ylemkimon

Vendors

Affected products

Weakness enumeration

CWE-532: Insertion of Sensitive Information into Log File

Related identifiers

CVE-2020-37267