Renovate High-Severity Advisory: Malicious GitHub Servers Could Steal Credentials

Renovate shipped a fix for a high-severity advisory (CVSS 8.6) that turns pagination into a credential leak. When Renovate talks to a GitHub server, it follows the pagination links in the server's Link header and sends your credentials along to the 'next' page. A malicious or compromised GitHub server can point that next link at an attacker-controlled host, and Renovate will hand your tokens over.

The affected surface is platform=github plus the github-* and git-* datasources. There is no workaround. The fix is in Renovate 44.11.3, and the Mend images carry it as 15.4.0.

Here is the part that should change your morning. Renovate is a core part of many teams' automated dependency-update pipelines, and it is the tool you have trusted with your tokens. Upgrading is the only move: bump a self-hosted install to 44.11.3, or move your Mend-managed images to 15.4.0, before the next scheduled run.

The trigger is narrow, so this is not a panic: the leak only fires against a GitHub server that is malicious or already compromised. But the advisory, GHSA-w57v-h33h-835c, sits at CVSS 8.6, and the fix is a version bump rather than a config change. That combination means you upgrade today, not whenever your next maintenance window rolls around.