CVE-2026-76227

Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure

State: Published
Severity: 6.8 Medium
Published: Aug 19, 2026
Updated: Oct 8, 2026
Reserved: Aug 19, 2026

Description

Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.

Scores

CVSS	Score	Vector	Source
4.0	6.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable

Affected Products

Product	Versions
renovaterenovatebot	42.68.1 to before 42.96.3Affected 42.96.3Not affected 43.0.0 to before 43.4.4Affected 43.4.4Not affected
renovate-cemend	13.3.0 to before 13.6.0Affected 13.6.0Not affected
renovate-ee-servermend	13.3.0 to before 13.6.0Affected 13.6.0Not affected
renovate-ee-workermend	13.3.0 to before 13.6.0Affected 13.6.0Not affected

References

GitHub Security Advisory (GHSA-8wc6-vgrq-x6cf)vendor-advisory
VulnCheck Advisory: Renovate 42.68.1 before 42.96.3 Environment Variable Exposurethird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.