Skip to content
Threat Feed
Subscribe

Product

Renovate (< 44.11.3)

2 briefs RSS
high advisory

Credential Disclosure in Renovate via Malicious Pagination Links

Renovate improperly validates HTTP 'Link' headers during GitHub API interactions, allowing a compromised GitHub server to exfiltrate configured credentials by redirecting pagination requests to an attacker-controlled host.

Renovate +5 credential-access supply-chain vulnerability supply-chain-security credential-theft nuget dependency-management
1t 1c
high advisory

Improper Link Header Validation in Renovate

Renovate versions prior to 44.11.3 fail to validate Link header destinations during GitLab server pagination, enabling attackers to exfiltrate credentials via malicious redirects.

Renovate +1 supply-chain vulnerability gitlab
1t 1c