High 7.7Published Sep 10, 2026

CVE-2026-88883Renovate before 44.14.4 TLS Private Key Log Sanitisation

Updated under an hour ago (2026-10-19 06:20 UTC)

Does this affect you?

It affects renovatebot renovate and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for renovatebot renovate

Exploited in the last 30 days

Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0), log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of hostRules[].httpsPrivateKey was redacted in the field itself, the same private key value was not redacted if it also appeared elsewhere — for example in another configuration option or in a log message under a key other than httpsPrivateKey — causing the full private key to be written to Renovate's logs in cleartext. This affects deployments that configure Mutual TLS through hostRules[].httpsPrivateKey without passing the value through the documented `secrets` configuration. Anyone able to read the resulting logs can recover the private key. The issue is fixed in Renovate 44.14.4, which redacts any value supplied as hostRules[].httpsPrivateKey wherever it appears in the logs; as a workaround, supply the key via the `secrets` configuration.

CVSS: 7.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness (CWE): CWE-532
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Awaiting Analysis
Record last updated: Sep 29, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

renovatebot renovate renovatebot:renovate (from the name)	before 44.14.4; 44.14.4 not affected	CNA record
mend renovate-ce mend:renovate_ce (from the name)	before 15.4.0; 15.4.0 not affected	CNA record
mend renovate-ee-server mend:renovate_ee_server (from the name)	before 15.4.0; 15.4.0 not affected	CNA record
mend renovate-ee-worker mend:renovate_ee_worker (from the name)	before 15.4.0; 15.4.0 not affected	CNA record
mend mend-renovate-enterprise-edition mend:renovate_enterprise_edition (from the name)	before 10.4.0; 10.4.0 not affected	CNA record

References

https://github.com/renovatebot/renovate/security/advisories/GHSA-4hmw-qw74-vrhmvendor-advisory
https://www.vulncheck.com/advisories/renovate-before-44.14.4-tls-private-key-log-sanitisationthird-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.