CVE-2026-88883: Renovate before 44.14.4 TLS Private Key Log Sanitisation
Renovate is an automated dependency update tool. In versions before 44.14.4 (and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0), log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of hostRules[].httpsPrivateKey was redacted in the field itself, the same private key value was not redacted if it also appeared elsewhere — for example in another configuration option or in a log message under a key other than httpsPrivateKey — causing the full private key to be written to Renovate's logs in cleartext. This affects deployments that configure Mutual TLS through hostRules[].httpsPrivateKey without passing the value through the documented secrets configuration. Anyone able to read the resulting logs can recover the private key. The issue is fixed in Renovate 44.14.4, which redacts any value supplied as hostRules[].httpsPrivateKey wherever it appears in the logs; as a workaround, supply the key via the secrets configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 44.14.4 - Configuration
As a workaround for versions before 44.14.4 (and before 15.4.0 for Mend Renovate CE/EE images, and before 10.4.0 for the mend-renovate-enterprise-edition Helm chart), supply the Mutual TLS private key via the documented `secrets` configuration rather than passing it directly in `hostRules[].httpsPrivateKey`.
Renovate secrets = Provide TLS Private Key for Mutual TLS via `secrets` configuration instead of `hostRules[].httpsPrivateKey`
Event History
Frequently Asked Questions
Which deployments are exposed to private-key disclosure?
Deployments are affected if they configure Mutual TLS with hostRules[].httpsPrivateKey and provide that value directly rather than through the documented secrets configuration. The affected versions are Renovate before 44.14.4, Mend Renovate CE/EE images before 15.4.0, and the mend-renovate-enterprise-edition Helm chart before 10.4.0.
What access does an attacker need to obtain the private key?
An attacker needs the ability to read Renovate logs that contain the unredacted key value. No further interaction is required once the private key has been written to the logs.
What can be done if upgrading is not immediately possible?
Supply the Mutual TLS private key through the documented secrets configuration rather than directly in hostRules[].httpsPrivateKey. Restrict access to existing Renovate logs, because previously generated logs may already contain the key in cleartext.
How can I determine whether a key may have been exposed already?
Review Renovate logs from affected deployments for the TLS private-key value appearing under configuration fields or log keys other than httpsPrivateKey. If the key was configured directly and is found in logs, treat it as recoverable by anyone who could read those logs.