CVE-2026-88880

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.

Scoring

Severity

CRITICAL

CVSS base score

9.2

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

CWE

CWE-601

Published

2026-09-10

Last modified

2026-09-10

Affected products

• renovatebot renovate
• renovatebot renovate
• renovatebot renovate
• renovatebot renovate

Weakness type

• CWE-601

Related vulnerabilities

• CVE-2026-88887 — Renovate before 44.11.2 Credential Exfiltration via Link Header
• CVE-2026-88882 — Renovate before 44.11.2 Credential Exfiltration via Link Header
• CVE-2026-88881 — Renovate before 44.11.3 Credential Exfiltration via Link Header
• CVE-2026-8323 — Open Redirect in Armiya Information Technologies' Access Control System
• CVE-2026-86756 — Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState
• CVE-2026-78377 — Open Redirect in Yordam Informatics's Library Automation System
• CVE-2026-84389 — A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0...
• CVE-2026-86351 — MISP User Homepage Validation Allows Authenticated Open Redirect via Protocol-Relative URL

Markdown version · Browse all CVEs