Renovate versions prior to 44.14.4 (including Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0) suffer from incomplete log sanitization of TLS private keys used for Mutual TLS. Although the hostRules[].httpsPrivateKey field itself is redacted, the same private key may be logged in cleartext if it appears in other configuration options or log messages under different keys. This results in the full private key being exposed in logs. The vulnerability affects deployments that configure Mutual TLS by directly setting hostRules[].httpsPrivateKey without using the documented secrets configuration. The issue is resolved in Renovate 44.14.4, which ensures redaction of the private key value wherever it appears in logs. As a workaround, users can supply the private key via the secrets configuration to avoid exposure.

An attacker or unauthorized user with access to Renovate logs can recover the full TLS private key used for Mutual TLS authentication if the key was configured directly in hostRules[].httpsPrivateKey without using the secrets configuration. This exposure compromises the confidentiality of the private key, potentially allowing impersonation or interception of secure communications that rely on Mutual TLS. The vulnerability has a high severity score (CVSS 8.3) due to network attack vector, low attack complexity, no privileges required, and high confidentiality impact.

Upgrade Renovate to version 44.14.4 or later, which fixes the incomplete redaction of TLS private keys in logs. As a workaround, configure Mutual TLS private keys using the documented secrets configuration instead of directly setting hostRules[].httpsPrivateKey to prevent private key exposure in logs. Patch status is not explicitly stated in the vendor advisory, but the fix is included in Renovate 44.14.4. Check the official Renovate release notes or vendor advisory for confirmation and further guidance.