[CVE-2026-88880] Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagi…

Descripción técnica

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.

Puntuación CVSS

Score: 8.6/10 — Severidad: HIGH — Estado NIST: Undergoing Analysis

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Debilidades (CWE)

CWE-601

Fuente oficial

Publicado en NIST NVD.