CVE-2020-37267
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.31%
- CWE
- CWE-532
- Published
- 2026-08-19
- Last modified
- 2026-08-19
Affected products
- renovatebot renovate
- renovatebot renovate
Weakness type
Related vulnerabilities
- CVE-2026-22778 — vLLM leaks a heap address when PIL throws an error
- CVE-2025-14437 — Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
- CVE-2026-5128 — A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker
- CVE-2026-25813 — PlaciPy Exposes Sensitive Data via Application Logs
- CVE-2026-23493 — Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
- CVE-2026-82434 — Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
- CVE-2026-49200 — Acer Wave 7 router: Broken Access Control
- CVE-2026-9699 — Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors