Description

Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-19T14:17:16.033Z",
  "pubdate": "2026-08-19T14:17:16.033Z",
  "executiveSummary": "A credential exposure vulnerability exists in Renovate versions >=19.180.0 and <23.25.1 when integrated with Azure DevOps.\nThe vulnerability arises due to the unredacted logging of the git http.extraheader=AUTHORIZATION parameter within server or pipeline execution logs.\nConsequently, malicious actors or unauthorized users with read access to saved build logs can extract sensitive bot authorization tokens.\nThis exposure allows unauthorized privilege escalation and lateral movement by leveraging compromised bot credentials against Azure DevOps repositories.\nExploitation requires read access to execution logs generated by vulnerable pipeline runs.\nMitigation requires updating Renovate to version 23.25.1 or later, and affected users must immediately revoke and regenerate exposed credentials.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure handling and logging of Git configuration parameters during HTTP operations executed by the Renovate bot.\nSpecifically, when Renovate interacts with Azure DevOps, it supplies authorization credentials via the git http.extraheader=AUTHORIZATION configuration parameter to authenticate Git operations.\nDuring the execution of these Git commands, the underlying process or wrapper logs the command-line arguments or environment configurations without applying proper redaction filters to sensitive headers.\nAs a result, the plaintext authorization token is written directly to standard output or standard error streams, which are subsequently captured by the CI/CD pipeline infrastructure and stored as persistent server or pipeline logs.\nThe vulnerable component is the credential handling and logging mechanism within Renovate versions >=19.180.0 and <23.25.1 when configured for Azure DevOps environments.\nNo special network exposure, advanced authentication, or elevated privileges are required for exploitation beyond the capability to read stored pipeline or server execution logs where the plaintext token was recorded.\nThe attack flow proceeds as follows: 1) Renovate initiates an authenticated Git operation against an Azure DevOps repository; 2) The authorization token is injected via the http.extraheader parameter; 3) The execution logging mechanism records the raw command including the sensitive header value; 4) An attacker with access to historical pipeline logs extracts the plaintext authorization token; 5) The attacker uses the harvested bot credentials to impersonate the bot, gaining unauthorized access to repositories and associated resources.\nThe post-exploitation impact includes unauthorized access to source code repositories, potential code tampering, and exposure of additional integrated secrets."
}