Renovate versions prior to 44.11.2 (and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0) contain an open redirect vulnerability. When listing new package versions from a NuGet registry, renovate follows pagination URLs supplied in the HTTP Link header without verifying that the target URL shares the same origin as the configured registry. Because registry credentials are attached to the request for the next page, a malicious or compromised NuGet registry can supply a Link header pointing to an attacker-controlled server, causing renovate to send credentials to that server. Exploitation requires control or compromise of the NuGet registry, which would normally already have the credentials from the initial request. The vulnerability primarily allows credentials to be leaked to an additional attacker-chosen host. The fix restricts pagination URLs to the same origin, with an option to re-enable the previous behavior via RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN.

An attacker controlling or compromising a NuGet registry can cause renovate to send registry credentials to an attacker-controlled server by supplying malicious pagination URLs. This can lead to credential leakage beyond the initially compromised registry. However, since exploitation requires control of the registry, the impact is limited to credential exposure to an additional host rather than initial credential theft. The vulnerability has a high CVSS score of 9.2, indicating critical severity due to network attack vector, no required privileges or user interaction, and high impact on confidentiality.

A fix is available in renovate version 44.11.2 and in Mend Renovate CE/EE images and charts version 15.4.0 and later, as well as mend-renovate-enterprise-edition helm chart version 10.4.0 and later. The fix restricts pagination URLs to the same origin as the configured NuGet registry, preventing credentials from being sent to untrusted hosts. Users should upgrade to these fixed versions. If necessary, the previous behavior allowing cross-origin pagination can be re-enabled via the RENOVATE_X_NUGET_PAGINATION_ALLOW_CROSS_ORIGIN option, but this is not recommended.