Renovate follows pagination links provided in the HTTP 'Link' header from GitHub servers when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server. It sends credentials configured for the host to the URL specified as the 'next' page without validating that the URL belongs to the original host. If the GitHub server is malicious or compromised, it can supply a 'Link' header pointing to an attacker-controlled host, causing Renovate to disclose credentials to that host. The vulnerability requires the GitHub server Renovate communicates with to be malicious or compromised. The issue is resolved in Renovate 44.11.3 and corresponding Mend Renovate CE/EE and helm chart versions.

An attacker controlling or compromising the GitHub server Renovate interacts with can cause Renovate to send sensitive credentials to an attacker-controlled URL via an open redirect in pagination links. This leads to credential disclosure with high confidence due to the CVSS 9.2 score and the nature of the vulnerability. However, exploitation requires prior compromise or malicious control of the GitHub server, limiting the attack scope.

A fixed version is available: Renovate 44.11.3 (npm and container images), Mend Renovate CE/EE images and mend-renovate-ce helm chart 15.4.0, and mend-renovate-enterprise-edition helm chart 10.4.0. Users should upgrade to these versions to remediate the vulnerability. There is no workaround; the existing RENOVATE_X_REBASE_PAGINATION_LINKS option disables the new host check but should only be used with trusted servers. Patch status is confirmed by the vendor advisory.