CVE-2026-76227

Awaiting Analysis Awaiting Analysis - Queue

Renovate Environment Variable Exposure Leading to Secret Leakage

Publication date: 2026-08-19

Last updated on: 2026-10-08

Assigner: VulnCheck

Description

Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-08-19

EPSS Evaluated

2026-10-16

NVD

CVE-2026-76227

EUVD

EUVD-2026-62468

Affected Vendors & Products

Vendor	Product	Version / Range
renovate	renovate	From 42.68.1 (inc) to 42.96.3 (exc)
mend	renovate-ce	From 13.3.0 (inc) to 13.6.0 (exc)
renovate	mend_renovate_ce	From 42.68.1 (inc) to 42.96.3 (exc)
renovate	renovate_ee_server	From 42.68.1 (inc) to 42.96.3 (exc)
renovate	renovate_ee_worker	From 42.68.1 (inc) to 42.96.3 (exc)
renovate	renovate	From 42.68.1 (inc) to 43.4.4 (exc)
renovate	mend_renovate_ce	From 42.68.1 (inc) to 43.4.4 (exc)
renovate	renovate_ee_server	From 42.68.1 (inc) to 43.4.4 (exc)
renovate	renovate_ee_worker	From 42.68.1 (inc) to 43.4.4 (exc)
renovate	renovate	From 13.3.0 (inc) to 13.6.0 (exc)
renovate	mend_renovate_ce	From 13.3.0 (inc) to 13.6.0 (exc)
renovate	renovate_ee_server	From 13.3.0 (inc) to 13.6.0 (exc)
renovate	renovate_ee_worker	From 13.3.0 (inc) to 13.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-526	The product uses an environment variable to store unencrypted sensitive information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Renovate versions between 42.68.1 and patched versions (42.96.3, 43.4.4, or later). Child processes spawned by Renovate incorrectly inherit full access to all environment variables of the Renovate process. This allows child processes like npm install or postUpgradeTasks to potentially access and exfiltrate sensitive secrets.

Detection Guidance

Check Renovate version with 'renovate --version' or inspect Docker images with 'docker inspect <image>'. Look for versions between 42.68.1 and 42.96.2 or 43.4.3 and earlier. Review environment variables in Renovate logs or Docker run commands for exposed secrets.

Impact Analysis

Attackers could exfiltrate secrets accessible to the Renovate deployment, including credentials or sensitive data. Users should rotate and revoke any credentials Renovate had access to as a precaution. The vulnerability also requires upgrading to patched versions to prevent further exposure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as secrets or credentials, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Exposure of environment variables containing such data could result in non-compliance with these regulations due to potential data breaches.

Mitigation Strategies

Upgrade Renovate to versions 42.96.3, 43.4.4, or later. For Docker, update to images >=13.6.0. Rotate and revoke all credentials Renovate had access to. Review and restrict environment variables in Renovate configurations to an allowlist.

Hi! I’m here to help you understand CVE-2026-76227. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70