CVE-2026-76227 PUBLISHED

Renovate 42.68.1 before 42.96.3 Environment Variable Exposure

Assigner: VulnCheck
Reserved: 19.08.2026 Published: 19.08.2026 Updated: 19.08.2026

Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.8

Product Status

Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 42.68.1 to 42.96.3 (excl.)
  • Version 42.96.3 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 42.68.1 to 43.4.4 (excl.)
  • Version 43.4.4 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 42.68.1 to 42.96.3 (excl.)
  • Version 42.96.3 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 42.68.1 to 43.4.4 (excl.)
  • Version 43.4.4 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 42.68.1 to 42.96.3 (excl.)
  • Version 42.96.3 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 42.68.1 to 43.4.4 (excl.)
  • Version 43.4.4 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 42.68.1 to 42.96.3 (excl.)
  • Version 42.96.3 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 42.68.1 to 43.4.4 (excl.)
  • Version 43.4.4 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 13.3.0 to 13.6.0 (excl.)
  • Version 13.6.0 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 13.3.0 to 13.6.0 (excl.)
  • Version 13.6.0 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 13.3.0 to 13.6.0 (excl.)
  • Version 13.6.0 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 13.3.0 to 13.6.0 (excl.)
  • Version 13.6.0 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 13.3.0 to 13.6.0 (excl.)
  • Version 13.6.0 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 13.3.0 to 13.6.0 (excl.)
  • Version 13.6.0 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 13.3.0 to 13.6.0 (excl.)
  • Version 13.6.0 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 13.3.0 to 13.6.0 (excl.)
  • Version 13.6.0 is unaffected
Vendor renovatebot
Product renovate
Versions Default: unaffected
  • affected from 13.3.0 to 13.6.0 (excl.)
  • Version 13.6.0 is unaffected

Credits

  • viceice reporter

References

Problem Types

  • Cleartext Storage of Sensitive Information in an Environment Variable CWE