Security Advisory

CVE-2026-88880

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-10 13:05:31

Last updated 2026-09-10 13:05:31

Assigner VulnCheck

CVSS score 9.2

State PUBLISHED

Description

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.

← Browse all CVEs View on cve.org ↗