{"id":"EUVD-2020-31261","enisaUuid":"f5b8f915-5d48-3b29-a89f-6272b7b91a40","description":"Renovate versions \u003e\u003d19.180.0 and \u003c23.25.1, when used with Azure DevOps, may expose the bot\u0027s authorization token in server or pipeline logs because the git http.extraheader\u003dAUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.","datePublished":"Aug 19, 2026, 2:01:49 PM","dateUpdated":"Aug 19, 2026, 3:31:29 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj\nhttps://www.vulncheck.com/advisories/renovate-before-token-leakage-via-logs\n","aliases":"CVE-2020-37267\nGHSA-w8hm-jrh2-57j3\n","assigner":"VulnCheck","epss":0.43,"enisaIdProduct":[{"id":"1c79f3d3-3d08-3daa-96ce-856d69164db6","product":{"name":"renovate","vendor":{"name":"renovatebot"}},"product_version":"19.180.0 \u003c23.25.1"}],"enisaIdVendor":[{"id":"b7b81bb1-e55e-3693-b5fe-9e5c273d7bbf","vendor":{"name":"renovatebot"}}],"enisaIdVulnerability":[{"id":"89009f0d-64ca-3298-aaa6-fc735d542480","vulnerability":{"id":"CVE-2020-37267","description":"Renovate versions \u003e\u003d19.180.0 and \u003c23.25.1, when used with Azure DevOps, may expose the bot\u0027s authorization token in server or pipeline logs because the git http.extraheader\u003dAUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.","datePublished":"Aug 19, 2026, 2:01:49 PM","dateUpdated":"Aug 19, 2026, 3:31:29 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj\nhttps://www.vulncheck.com/advisories/renovate-before-token-leakage-via-logs\n","enisa_id":"EUVD-2020-31261\n","assigner":"VulnCheck","epss":0.43,"dataProcessed":"Nov 3, 2026, 7:16:37 AM","vulnerabilityProduct":[{"id":"555fd877-0781-3563-aa66-22f871a8c91d","product":{"name":"renovate","vendor":{"name":"renovatebot"}},"product_version":"19.180.0 \u003c23.25.1"}],"vulnerabilityVendor":[{"id":"a7cac09c-7112-355a-b95d-f03675cb025e","vendor":{"name":"renovatebot"}}]}},{"id":"a4200aa7-98a0-3fbd-9c5c-9482234e1cc9","vulnerability":{"id":"GHSA-w8hm-jrh2-57j3","description":"Renovate versions \u003e\u003d19.180.0 and \u003c23.25.1, when used with Azure DevOps, may expose the bot\u0027s authorization token in server or pipeline logs because the git http.extraheader\u003dAUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.","datePublished":"Aug 19, 2026, 3:32:25 PM","dateUpdated":"Aug 19, 2026, 3:32:25 PM","baseScore":0.0,"references":"https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-37267\nhttps://www.vulncheck.com/advisories/renovate-before-token-leakage-via-logs\n","enisa_id":"EUVD-2020-31261\n","aliases":"CVE-2020-37267\nGHSA-w8hm-jrh2-57j3\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:04:29 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}