EUVD-2026-75433
GHSA-qfw4-mmpc-67w5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Log access requires low privilege; scope changes because recovered key compromises downstream mTLS-protected systems; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0), log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of hostRules[].httpsPrivateKey was redacted in the field itself, the same private key value was not redacted if it also appeared elsewhere - for example in another configuration option or in a log message under a key other than httpsPrivateKey - causing the full private key to be written to Renovate's logs in cleartext. This affects deployments that configure Mutual TLS through hostRules[].httpsPrivateKey without passing the value through the documented secrets configuration. Anyone able to read the resulting logs can recover the private key. The issue is fixed in Renovate 44.14.4, which redacts any value supplied as hostRules[].httpsPrivateKey wherever it appears in the logs; as a workaround, supply the key via the secrets configuration.
AnalysisAI
Incomplete log sanitization in Renovate before 44.14.4 causes Mutual TLS private keys to be written in cleartext to application logs, exposing mTLS credentials to anyone with log read access. When hostRules[].httpsPrivateKey is configured directly (rather than via the documented secrets mechanism), the value is redacted in the field context but leaks verbatim wherever it appears elsewhere in log output - including interpolated log messages and aliased configuration keys. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must both be true: (1) the deployment configures Mutual TLS authentication by supplying a PEM private key directly in hostRules[].httpsPrivateKey rather than referencing it through the secrets abstraction (e.g., secrets.MY_KEY_SECRET); and (2) the attacker can read Renovate's log output - whether from a CI/CD log stream, a centralized log aggregation platform, a shared filesystem, or container stdout. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N, score 8.3) appropriately captures the key risk signals: low-privilege log access is sufficient, no interaction is needed, and the subsequent-system confidentiality impact is high because the leaked private key can be used to authenticate as Renovate against mTLS-protected endpoints beyond the Renovate host itself. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Renovate to version 44.14.4 or later, which redacts any value supplied as hostRules[].httpsPrivateKey wherever it appears in log output, not just at the httpsPrivateKey field position. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Renovate deployments and audit hostRules configuration to identify instances where mTLS private keys were configured directly rather than through documented secrets mechanisms; inspect recent logs for potential credential exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential disclosure in Renovate before 44.11.3 allows a malicious or compromised GitHub server to exfiltrate host cred
Credential exfiltration in Renovate (renovatebot/renovate) before 44.11.2 lets a malicious or compromised container regi
Credential exfiltration in Renovate before 44.11.2 (and Mend Renovate CE/EE images/charts before 15.4.0, enterprise-edit
Credential exfiltration in Renovate before 44.11.3 lets a malicious or compromised GitLab server steal the authenticatio
Command injection in Renovate's hermit manager (versions 32.135.0 through 40.33.0) allows an attacker with repository wr
Command injection in Renovate's helmv3 manager (versions 31.51.0 through 40.32.x) allows repository contributors with wr
Command injection in Renovate's npm manager (versions 35.63.0 through 40.33.0) allows attackers with repository write ac
Command injection in Renovate's gleam manager (versions 39.53.0 through 40.33.0 exclusive) allows attackers with reposit
Command injection in Renovate's kustomize manager (versions 39.218.0 through 40.33.0) allows repository contributors wit
Command injection in Renovate's Gradle Wrapper update mechanism allows arbitrary code execution inside the Renovate runt
Command injection in Renovate's Gradle Wrapper manager module allows a repository contributor to execute arbitrary OS co
Command injection in Renovate's Maven Wrapper manager allows an attacker with write access to a scanned repository to ex
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today