Renovate follows pagination links provided by container registries in the HTTP Link header when listing tags or digests for container images. It attaches registry credentials to these follow-up requests without verifying that the pagination URL shares the same origin as the original registry. A malicious or compromised registry can exploit this by specifying a Link header pointing to an attacker-controlled host, thereby capturing the credentials Renovate uses for that registry. Exploitation requires the target to have container dependencies and to be interacting with the malicious registry. The issue is resolved in Renovate 44.11.2 (npm and renovate/renovate images), Mend Renovate CE/EE 15.4.0, and mend-renovate-enterprise-edition Helm chart 10.4.0. The same-origin check can be disabled via the RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN environment variable.

An attacker controlling or compromising a container registry can trick Renovate into sending sensitive registry credentials to an attacker-controlled host by manipulating pagination links. This could lead to credential exposure and unauthorized access to container registries. The vulnerability has a CVSS 4.0 score of 9.2 (critical), indicating high impact with no required privileges or user interaction for exploitation.

A fix is available and should be applied by upgrading to Renovate 44.11.2 (npm and renovate/renovate images), Mend Renovate CE/EE 15.4.0, or mend-renovate-enterprise-edition Helm chart 10.4.0. Users should avoid disabling the same-origin check (RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN) unless absolutely necessary, as this weakens security. Patch status is confirmed by vendor advisory information embedded in the description.