High severity · published Aug 19, 2026
CVE-2019-25766
Renovate before 19.38.7 Credential Exposure via Go Modules
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obtain the exposed tokens.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
renovate · renovatebot
13.87.0 before 19.38.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25766
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25766
github.com
https://github.com/renovatebot/renovate/security/advisories/GHSA-v7x3-7hw7-pcjg
www.vulncheck.com
https://www.vulncheck.com/advisories/renovate-before-credential-exposure-via-go-modules
More from renovate
8.6
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88882
Renovate before 44.11.2 Credential Exfiltration via Link Header
8.6
CVE-2026-88881
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.6
CVE-2026-88880
Renovate before 44.11.3 Credential Exfiltration via Link Header
8.5
CVE-2026-110868
Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources