CVE-2020-37267: Renovate Information Disclosure Flaw

CVE-2020-37267 Overview

CVE-2020-37267 is an information disclosure vulnerability in Renovate, an automated dependency update tool. Versions >=19.180.0 and <23.25.1 leak the bot's authorization token into server or pipeline logs when integrated with Azure DevOps. The git http.extraheader=AUTHORIZATION parameter is written to logs without redaction. Anyone with access to stored logs can extract the bot credentials and impersonate the Renovate bot against connected repositories. The issue is classified under CWE-532: Insertion of Sensitive Information into Log File. Renovate 23.25.1 resolves the flaw, and affected Azure DevOps users must revoke and regenerate exposed credentials.

Critical Impact
Attackers with access to Renovate server or Azure DevOps pipeline logs can harvest bot authorization tokens and use them to read or modify source code across all repositories the bot can reach.

Affected Products

Renovate versions >=19.180.0 and <23.25.1
Renovate deployments integrated with Azure DevOps
Self-hosted Renovate bots writing pipeline or server logs to persistent storage

Discovery Timeline

2026-08-19 - CVE-2020-37267 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2020-37267

Vulnerability Analysis

Renovate authenticates to Azure DevOps by injecting an HTTP Authorization header into git operations via the http.extraheader configuration parameter. When Renovate executes git commands, it passes this header as a command-line argument. The command line and its arguments are then written verbatim to server logs and CI pipeline output. Because the token appears as plaintext within the argument value, no redaction is applied before logging. Any principal with read access to those logs, including CI operators, log aggregation systems, and downstream SIEM pipelines, can recover the token. The recovered token carries the bot's full permissions to clone, push, and modify pull requests across every repository connected to the Renovate installation, enabling supply-chain tampering.

Root Cause

The root cause is missing sanitization of sensitive command-line arguments before logging. Renovate constructs the git invocation with the authorization value embedded as a literal string, then emits the full command through its logger. The logger has no allowlist or regex-based scrubber to strip credential material from http.extraheader values. The fix in 23.25.1 redacts the header contents from log output.

Attack Vector

Exploitation does not require direct network access to the Renovate host. An attacker only needs read access to any surface where Renovate logs are stored, including Azure DevOps pipeline run logs, self-hosted CI job logs, container stdout captured by log shippers, or archived log files in object storage. After extracting the token from log text, the attacker replays it against Azure DevOps REST or git endpoints to interact with repositories as the bot. See the GitHub Security Advisory GHSA-36rh-ggpr-j3gj and the VulnCheck Security Advisory for additional technical context.

Detection Methods for CVE-2020-37267

Indicators of Compromise

Log lines containing the string http.extraheader=AUTHORIZATION followed by a Basic or Bearer credential value
Git process invocations with -c http.extraheader= arguments captured in process telemetry
Unexpected pushes, branch creations, or pull request activity originating from the Renovate bot identity outside its normal schedule
Azure DevOps audit events showing token use from IP addresses outside the known Renovate infrastructure

Detection Strategies

Grep historical CI and Renovate server logs for the pattern http\.extraheader.*[Aa]uthorization to identify exposed tokens
Correlate Azure DevOps personal access token usage against the expected Renovate source IP ranges and flag deviations
Alert on any git command line captured by endpoint telemetry that contains the substring extraheader combined with Authorization

Monitoring Recommendations

Enable audit logging on all Azure DevOps organizations connected to Renovate and forward events to a central data lake
Monitor pull request creation and repository writes by the Renovate service principal for anomalous timing or content
Review access controls on log aggregation platforms so that only authorized operators can read raw pipeline output

How to Mitigate CVE-2020-37267

Immediate Actions Required

Upgrade Renovate to version 23.25.1 or later on all self-hosted deployments
Revoke and regenerate every Azure DevOps personal access token or service principal secret used by Renovate if logs may have been exposed
Purge or restrict access to historical logs that may contain leaked http.extraheader values
Rotate any downstream credentials that the Renovate bot could reach through repository access

Patch Information

The vulnerability is fixed in Renovate 23.25.1. The patch redacts the http.extraheader authorization value before it is written to logs. Refer to the GitHub Security Advisory GHSA-36rh-ggpr-j3gj for the maintainer's fix notes and version guidance.

Workarounds

If immediate upgrade is not possible, restrict read access to Renovate server and Azure DevOps pipeline logs to a minimal set of administrators
Configure log shippers to drop or mask lines containing extraheader before shipping to shared storage
Scope Renovate tokens to the minimum required repositories and permissions to limit blast radius if a token is leaked

bash

# Configuration example: mask extraheader values in log pipeline (Fluent Bit)
[FILTER]
    Name    modify
    Match   renovate.*
    Condition Key_value_matches log .*http\.extraheader.*
    Set     log "[REDACTED http.extraheader line]"