CVE-2026-76227
Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
CVSS Score
5.5
EPSS Score
0.2%
EPSS Percentile
4th
Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
| CWE | CWE-526 |
| Vendor | renovatebot |
| Product | renovate |
| Published | Aug 19, 2026 |
| Last Updated | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for renovatebot renovate
Be the first to know when new medium vulnerabilities affecting renovatebot renovate are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
renovatebot / renovate
42.68.1 < 42.96.3 43.0.0 < 43.4.4
mend / renovate-ce
13.3.0 < 13.6.0
mend / renovate-ee-server
13.3.0 < 13.6.0
mend / renovate-ee-worker
13.3.0 < 13.6.0
References
Credits
🔍 viceice