CVE-2026-76227
Received Received - Intake

Renovate Environment Variable Exposure Leading to Secret Leakage

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: VulnCheck

Description
Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-76227
EUVD
EUVD-2026-62468

Affected Vendors & Products

Showing 13 associated CPEs
Vendor Product Version / Range
renovate renovate From 42.68.1 (inc) to 42.96.3 (exc)
mend renovate-ce From 13.3.0 (inc) to 13.6.0 (exc)
renovate mend_renovate_ce From 42.68.1 (inc) to 42.96.3 (exc)
renovate renovate_ee_server From 42.68.1 (inc) to 42.96.3 (exc)
renovate renovate_ee_worker From 42.68.1 (inc) to 42.96.3 (exc)
renovate renovate From 42.68.1 (inc) to 43.4.4 (exc)
renovate mend_renovate_ce From 42.68.1 (inc) to 43.4.4 (exc)
renovate renovate_ee_server From 42.68.1 (inc) to 43.4.4 (exc)
renovate renovate_ee_worker From 42.68.1 (inc) to 43.4.4 (exc)
renovate renovate From 13.3.0 (inc) to 13.6.0 (exc)
renovate mend_renovate_ce From 13.3.0 (inc) to 13.6.0 (exc)
renovate renovate_ee_server From 13.3.0 (inc) to 13.6.0 (exc)
renovate renovate_ee_worker From 13.3.0 (inc) to 13.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-526 The product uses an environment variable to store unencrypted sensitive information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Renovate versions between 42.68.1 and patched versions (42.96.3, 43.4.4, or later). Child processes spawned by Renovate incorrectly inherit full access to all environment variables of the Renovate process. This allows child processes like npm install or postUpgradeTasks to potentially access and exfiltrate sensitive secrets.

Detection Guidance

Check Renovate version with 'renovate --version' or inspect Docker images with 'docker inspect <image>'. Look for versions between 42.68.1 and 42.96.2 or 43.4.3 and earlier. Review environment variables in Renovate logs or Docker run commands for exposed secrets.

Impact Analysis

Attackers could exfiltrate secrets accessible to the Renovate deployment, including credentials or sensitive data. Users should rotate and revoke any credentials Renovate had access to as a precaution. The vulnerability also requires upgrading to patched versions to prevent further exposure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as secrets or credentials, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Exposure of environment variables containing such data could result in non-compliance with these regulations due to potential data breaches.

Mitigation Strategies

Upgrade Renovate to versions 42.96.3, 43.4.4, or later. For Docker, update to images >=13.6.0. Rotate and revoke all credentials Renovate had access to. Review and restrict environment variables in Renovate configurations to an allowlist.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76227. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart