Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-19T14:01:49 renovate: Renovate: Information disclosure via unredacted logging of authorization tokens 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CWE-538

Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.

A flaw was found in Renovate. When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the `git http.extraheader=AUTHORIZATION` parameter is logged without redaction. An attacker with access to these logs could obtain the bot's credentials, leading to unauthorized access.

This flaw has an IMPORTANT impact on Renovate, which logged authorization tokens without redaction, potentially disclosing them to anyone with access to the log output. The version of Renovate shipped by Red Hat is well beyond the upstream fix (23.25.1); the unredacted-logging code is not present in the shipped version, so Red Hat's product is not affected. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. https://www.cve.org/CVERecord?id=CVE-2020-37267 https://nvd.nist.gov/vuln/detail/CVE-2020-37267 https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj https://www.vulncheck.com/advisories/renovate-before-token-leakage-via-logs