Vulnerability Intelligence Report
Renovate 19.180.0 before 23.25.1 Token Leakage via Logs
CVE-2020-37267
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.
No Active Exploit Signals
CVSS Base Score
8.7
HIGH
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-532 ↗Insertion of Sensitive Information into Log File
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| renovatebot | renovate | 19.180.0 < 23.25.1 (affected), 23.25.1 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-08-19T11:37:41 |
| Published | 2026-08-19T14:01:49 |
| Patch Date | 2020-09-12 |
| Last Updated | 2026-08-19T15:31:29 |
Community Chatter & Buzz