Description

Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T14:17:14.937Z",
  "pubdate": "2026-08-19T14:17:14.937Z",
  "executiveSummary": "A credential exposure vulnerability exists in Renovate versions >= 13.87.0 and <= 19.38.6, specifically involving the leakage of temporary repository tokens into pull request comments during specific Go Modules update failure scenarios.\nThe primary impact of this vulnerability is unauthorized access and potential privilege escalation, as any user with visibility into the affected pull request comments can harvest the exposed sensitive authentication tokens.\nThe affected product is Renovate, impacting automated dependency update workflows within software development pipelines.\nRisk implications include potential unauthorized access to source code repositories, tampering with CI/CD pipelines, and unauthorized code commits or modifications.\nAn attacker requires read access to affected pull request comments where update failures occurred to successfully acquire the leaked tokens.\nNo complex exploitation capabilities are required, as the vulnerability passively exposes credentials in public or internal repository communication channels upon error handling failures.",
  "technicalDetails": "The vulnerability resides in the error handling and logging mechanisms of the Renovate application when processing Go Modules updates.\nThe root cause stems from insecure string formatting or error reporting routines that inadvertently append sensitive temporary repository authentication tokens to exception outputs or diagnostic messages.\nDuring specific Go Modules update failure scenarios, these error messages—containing the active temporary repository tokens—are automatically posted as comments on the corresponding pull requests.\nThe vulnerable components are the modules responsible for interacting with Go Modules and managing pull request commentary within Renovate versions >= 13.87.0 and <= 19.38.6.\nThe attack flow proceeds as follows: First, Renovate attempts to process a Go Modules dependency update using a temporary repository token. Second, an unexpected update failure occurs, triggering the application's error handling routine. Third, the error handler formats a diagnostic comment for the pull request, incorrectly embedding the raw temporary repository token into the message payload. Fourth, Renovate publishes the comment to the hosting platform's pull request interface. Finally, any authenticated or unauthenticated user (depending on repository visibility settings) capable of viewing the pull request extracts the exposed token from the comment history.\nAuthentication and privilege requirements for exploitation are minimal; an attacker only needs sufficient access permissions to view the pull request comments on the target repository.\nNetwork exposure is dictated by the code hosting platform where the pull requests are hosted, typically exposing the secrets over standard HTTPS APIs and web interfaces.\nPost-exploitation impact allows unauthorized actors to leverage the compromised temporary repository tokens to interact with the repository API, potentially reading private codebases, modifying source files, or executing further unauthorized pipeline actions depending on the token's scope and permissions."
}