Advisory severityMedium5.5Red Hat Linux

Medium [CVE-2026-88883] Information disclosure of TLS private keys via incomplete log sanitization

This medium-severity Red Hat Linux advisory covers CVE-2026-88883.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-88883 Source published Sep 10, 2026Source updated Sep 10, 2026

VulniPulse record published Sep 18, 2026Record updated Sep 25, 2026

CVE-2026-88883

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Information disclosure of TLS private keys via incomplete log sanitization. Red Hat rates this moderate (CVSS 5.5).

Weakness: CWE-117.

Affected versions

< 44.14.4
< 15.4.0
< 10.4.0

Official advisory · high-confidence parse· fetched 15 days ago·verify at source

Fixed versions

44.14.4

Official advisory · high-confidence parse· fetched 15 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

To mitigate this issue, ensure that TLS private keys for Mutual TLS in Renovate configurations are always supplied via the documented `secrets` mechanism. Avoid directly embedding private keys within the `hostRules[].httpsPrivateKey` field. Refer to Renovate's official documentation for proper `secrets` configuration to prevent cleartext logging of sensitive key material.

Official advisory · high-confidence parse· fetched 15 days ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.