Renovate versions prior to 44.11.3 fail to validate the destinations specified in the HTTP Link headers used for GitLab server pagination. This improper validation enables an open redirect scenario where a malicious or compromised GitLab server can craft a Link header pointing to an attacker-controlled site. When renovate follows this Link header, it may send credential-bearing requests to the attacker’s infrastructure, risking credential leakage. The vulnerability has a CVSS 4.0 score of 9.2, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and security capabilities.

An attacker controlling a compromised GitLab server can exploit this vulnerability to redirect renovate's credential-bearing requests to an attacker-controlled site. This can lead to exfiltration of authentication credentials, compromising the security of the renovate client and potentially any systems relying on those credentials. The vulnerability does not require user interaction or privileges, making it highly exploitable in affected environments.

No official fix or patch is currently confirmed for this vulnerability. Users should monitor the vendor advisory for updates and apply the official patch once available. Until then, avoid using renovate versions prior to 44.11.3 with untrusted or compromised GitLab servers. Consider restricting renovate's network access or using network controls to limit exposure to untrusted GitLab instances.