CVE-2026-76227
Renovate 42.68.1 before 42.96.3 Environment Variable Exposure
CVSS Score
5.5
EPSS Score
0.0%
EPSS Percentile
0th
Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
| CWE | CWE-526 |
| Vendor | renovatebot |
| Product | renovate |
| Published | Aug 19, 2026 |
Stay Ahead of the Next One
Get instant alerts for renovatebot renovate
Be the first to know when new medium vulnerabilities affecting renovatebot renovate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
renovatebot / renovate
42.68.1 < 42.96.3
renovatebot / renovate
42.68.1 < 43.4.4
renovatebot / renovate
42.68.1 < 42.96.3
renovatebot / renovate
42.68.1 < 43.4.4
renovatebot / renovate
42.68.1 < 42.96.3
renovatebot / renovate
42.68.1 < 43.4.4
renovatebot / renovate
42.68.1 < 42.96.3
renovatebot / renovate
42.68.1 < 43.4.4
renovatebot / renovate
13.3.0 < 13.6.0
renovatebot / renovate
13.3.0 < 13.6.0
renovatebot / renovate
13.3.0 < 13.6.0
renovatebot / renovate
13.3.0 < 13.6.0
renovatebot / renovate
13.3.0 < 13.6.0
renovatebot / renovate
13.3.0 < 13.6.0
renovatebot / renovate
13.3.0 < 13.6.0
renovatebot / renovate
13.3.0 < 13.6.0
renovatebot / renovate
13.3.0 < 13.6.0
References
Credits
🔍 viceice