CVE-2020-37267

high Red Hat
CVSS v3 Base Score
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
High
Integrity
None
Availability
None
Published: August 19, 2026 (18 days ago)
Last Modified: August 19, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in Renovate. When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the `git http.extraheader=AUTHORIZATION` parameter is logged without redaction. An attacker with access to these logs could obtain the bot's credentials, leading to unauthorized access.

CWE

CWE-538

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com 🔗 www.vulncheck.com