CVE-2026-76227Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
Updated under an hour ago ()
Does this affect you?
It affects renovatebot renovate and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
- CVSS
- 5.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-526
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Awaiting Analysis
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
renovatebot renovate renovatebot:renovate (from the name) | from 42.68.1 before 42.96.3; 42.96.3 not affected; from 43.0.0 before 43.4.4; 43.4.4 not affected | CNA record |
mend renovate-ce mend:renovate_ce (from the name) | from 13.3.0 before 13.6.0; 13.6.0 not affected | CNA record |
mend renovate-ee-server mend:renovate_ee_server (from the name) | from 13.3.0 before 13.6.0; 13.6.0 not affected | CNA record |
mend renovate-ee-worker mend:renovate_ee_worker (from the name) | from 13.3.0 before 13.6.0; 13.6.0 not affected | CNA record |
References
- https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cfvendor-advisory
- https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposurethird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.