A high severity credential exfiltration vulnerability in the Renovate dependency update tool allows unauthenticated attackers to steal registry credentials.

The application is susceptible to an open redirect flaw (CWE-601) during container registry interaction, where it fails to perform a same origin check on HTTP Link headers. An unauthenticated attacker operating a malicious or compromised registry can force the tool to send stored registry credentials to an external, attacker controlled host.

Successful exploitation poses a significant risk to the software supply chain by exposing sensitive container registry credentials. With these credentials, an attacker could potentially gain unauthorized access to private container images, perform unauthorized modifications, or pivot further into the development environment. The CVSS score of 8.6 reflects the high potential for impact on confidentiality and the ease with which this can be triggered over the network.

Immediate Action: Update Renovate to version 44.11.2 or later, or Mend Renovate CE/EE to version 15.4.0 or later.

Proactive Monitoring: Review registry access logs for unusual outbound requests or connections to unknown domains originating from the Renovate automation server.

Compensating Controls: If immediate patching is not feasible, set the environment variable RENOVATE_X_DOCKER_PAGINATION_ALLOW_CROSS_ORIGIN to false to enforce stricter origin validation.

Public Exploit Available: No

This vulnerability represents a critical risk to automated build pipelines and container management security. Administrators should prioritize updating their Renovate instances immediately to prevent potential credential theft. If updating is delayed, the provided environment variable toggle should be implemented as a mandatory temporary defense to ensure origin validation is enforced.