A vulnerability in the Renovate dependency update tool allows for the exfiltration of credentials to malicious hosts via unvalidated HTTP pagination links.

This issue is a URL redirection to an untrusted site (CWE-601) occurring within the Renovate pagination logic. The tool blindly follows the HTTP Link header provided by a server, which may point to an external host, resulting in the transmission of configured credentials to that unauthorized destination.

The exploitation of this vulnerability could lead to the compromise of sensitive credentials, including API keys or authentication tokens used by the Renovate tool to interact with GitHub environments. With a CVSS score of 8.6, this flaw presents a high risk, as it potentially grants attackers unauthorized access to internal source code repositories or dependency registries, leading to significant data exposure or supply chain compromise.

Immediate Action: Update the Renovate dependency tool to version 44.11.3 or higher, or update Mend Renovate CE/EE and Enterprise Edition to version 15.4.0 and 10.4.0 respectively.

Proactive Monitoring: Review audit logs for unusual outbound network connections from the Renovate host, specifically looking for traffic directed toward unexpected or unrecognized external domains.

Compensating Controls: Ensure that network egress filtering is applied to the Renovate environment to restrict connections only to known, trusted endpoints, thereby limiting the impact of potential credential leakage.

Public Exploit Available: Unknown

Given the high severity of this credential exfiltration flaw, organizations utilizing Renovate for dependency management must prioritize updating to the patched versions immediately. Failure to address this vulnerability exposes the environment to unauthorized access via compromised credentials, which could facilitate broader security breaches within the CI/CD pipeline.