Renovate: Ten Vulnerabilities Disclosed, Including Command Injection and Credential Exposure
Ten vulnerabilities impacting Renovate, a dependency update tool, were disclosed on September 10, 2026, with several allowing arbitrary command execution and credential exfiltration.
Key findings
- Ten vulnerabilities disclosed for Renovate on September 10, 2026, with most rated High severity.
- Multiple command injection flaws found in Maven Wrapper, Mix, Gradle Wrapper, and GoMod managers.
- Insecure handling of paginated API responses leads to potential credential exfiltration from registries and Git hosts.
- Vulnerabilities affect Renovate versions prior to 44.14.7, with specific versioning for other issues.
- Patches are available, with users urged to update to mitigate risks of code execution and data exposure.
On September 10, 2026, a batch of ten vulnerabilities was disclosed for Renovate, a popular dependency update automation tool. The vulnerabilities, primarily rated as High severity, expose users to risks including arbitrary command execution and credential exfiltration. The disclosures highlight issues across several Renovate managers, including Maven Wrapper, Mix, Gradle Wrapper, and GoMod, as well as problems with how Renovate handles paginated API responses from container registries, NuGet, and Git hosting services.
Several command injection vulnerabilities were detailed. CVE-2026-88889, affecting the Maven Wrapper manager, allows attackers to execute arbitrary commands by manipulating the distributionType parameter in maven-wrapper.properties. Similarly, CVE-2026-88888 (Mix manager) and CVE-2026-88885 (gomod manager) permit command injection through unescaped parameters in private dependency processing and import-path update commands, respectively, particularly in binarySource=docker mode. The Gradle Wrapper manager is also affected by a command injection flaw in CVE-2026-88886 due to unescaped distributionUrl values.
Beyond command injection, other critical issues involve insecure handling of paginated API responses. CVE-2026-88887, CVE-2026-88882, and CVE-2026-88881 detail how Renovate follows pagination links from container registries, NuGet registries, and GitHub, respectively. In these instances, Renovate forwards registry or host credentials to the paginated URLs without verifying that they share the same origin as the initial request, potentially leading to credential exfiltration. CVE-2026-88880 describes a similar vulnerability with GitLab, where failure to validate Link header destinations allows malicious servers to redirect credential-bearing requests.
Additionally, CVE-2026-88883 points to an incomplete log sanitization for TLS private keys used in Mutual TLS, where sensitive key information might not be fully redacted in logs. CVE-2026-88884, a medium severity vulnerability, indicates that digest updates were not subject to the internal minimumReleaseAge checks, potentially allowing for the promotion of unstable or older versions.
The disclosed vulnerabilities affect Renovate versions prior to 44.14.7 for most command injection flaws. Specific versions are also called out for other issues, such as CVE-2026-88884 affecting versions before 44.3.1, CVE-2026-88883 before 44.14.4, CVE-2026-88882 before 44.11.2, and CVE-2026-88880 before 44.11.3. Mend Renovate CE/EE distributions and Helm charts have separate versioning noted for some of these issues, generally requiring updates to versions 15.4.0 or 10.4.0 respectively. Users are strongly advised to update to the patched versions to mitigate these risks.
This coordinated disclosure underscores the importance of keeping Renovate updated, especially given the potential for arbitrary code execution and sensitive data exposure. The variety of affected managers and the common theme of insecure handling of external resource links suggest a need for thorough review of Renovate's security posture in handling configurations and external API interactions. Users should prioritize updating their Renovate instances to the latest available versions.