A critical vulnerability in Renovate allows unauthenticated attackers to exfiltrate credentials by manipulating pagination link headers, posing a significant risk to environment security.

The application is susceptible to an open redirect flaw (CWE-601) occurring during GitLab server pagination. An unauthenticated attacker can control the Link header destination to force the application to send credential-bearing requests to an attacker-controlled endpoint.

Successful exploitation allows for the theft of sensitive authentication credentials used by Renovate to interact with GitLab repositories. Given the CVSS score of 8.6, this vulnerability represents a high risk, as it could lead to unauthorized access to internal codebases, pipeline manipulation, or broader supply chain compromise.

Immediate Action: Update Renovate to version 44.11.3 or 15.4.0, depending on the specific branch in use, to include necessary input validation for Link headers.

Proactive Monitoring: Review egress traffic logs for unexpected connections to unknown or unauthorized external domains originating from the Renovate host.

Compensating Controls: Implement strict network egress filtering on the Renovate server to prevent connections to untrusted or non-essential external infrastructure.

Public Exploit Available: No (exploit_available: unknown)

The vulnerability presents a severe risk of credential theft that could facilitate further unauthorized access to development environments. Organizations should prioritize patching to the specified versions immediately to eliminate the redirection flaw and protect sensitive authentication tokens.