Vulnerability Intelligence Report
Renovate before 19.38.7 Credential Exposure via Go Modules
CVE-2019-25766
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
No Active Exploit Signals
CVSS Base Score
8.7
HIGH
EPSS Probability:0.31%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-532 ↗Insertion of Sensitive Information into Log File
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| renovatebot | renovate | 13.87.0 < 19.38.7 (affected), 19.38.7 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.314%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-08-19T11:37:57 |
| Published | 2026-08-19T14:01:48 |
| Patch Date | 2019-10-18 |
| Last Updated | 2026-08-25T01:52:11 |
Community Chatter & Buzz