CVE-2026-88880 — Renovate before 44.11.3 Credential Exfiltration via Link Header
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. A…
Published: 2026-09-10 · CVSS: 9.2 · CVSS 4.0
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7