A vulnerability in the Renovate dependency update tool allows for the exfiltration of sensitive NuGet registry credentials through improper validation of cross-origin pagination headers.

This vulnerability is classified as an Open Redirect (CWE-601) occurring during NuGet registry pagination. The application automatically follows HTTP Link headers without verifying that the destination shares the same origin as the original registry, allowing an unauthenticated attacker to redirect credential-laden requests to a malicious server.

The exploitation of this flaw leads to the unauthorized disclosure of sensitive registry credentials, which may provide attackers with persistent access to private software packages or internal infrastructure. With a CVSS score of 8.6, this vulnerability represents a high risk to supply chain integrity, as compromised credentials could facilitate the injection of malicious code into the development pipeline.

Immediate Action: Update Renovate to version 44.11.2 or later, Mend Renovate CE/EE to 15.4.0 or later, and the mend-renovate-enterprise-edition helm chart to 10.4.0 or later.

Proactive Monitoring: Review outbound network traffic logs for connections originating from the Renovate host to unexpected or untrusted domains.

Compensating Controls: Ensure that egress filtering is configured on the environment hosting Renovate to prevent unauthorized communication with external, non-whitelisted domains.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the security of your CI/CD pipeline and internal dependency management. IT administrators should prioritize the application of vendor-provided patches immediately to prevent potential credential theft. If immediate patching is not possible, ensure that registry configurations are strictly monitored and that egress traffic is restricted to known, trusted endpoints.