CVE-2026-76227

Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf
https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposure

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-19 14:17

Updated : 2026-09-08 20:28

NVD link : CVE-2026-76227

Mitre link : CVE-2026-76227

CVE.ORG link : CVE-2026-76227

JSON object : View

Products Affected

No product.

CWE

CWE-526

Cleartext Storage of Sensitive Information in an Environment Variable

{"id": "CVE-2026-76227", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76227", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T01:58:10.379378Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "42.68.1", "lessThan": "42.96.3", "versionType": "semver"}, {"status": "unaffected", "version": "42.96.3", "versionType": "semver"}], "packageURL": "pkg:npm/renovate", "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "42.68.1", "lessThan": "43.4.4", "versionType": "semver"}, {"status": "unaffected", "version": "43.4.4", "versionType": "semver"}], "packageURL": "pkg:npm/renovate", "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "42.68.1", "lessThan": "42.96.3", "versionType": "semver"}, {"status": "unaffected", "version": "42.96.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "42.68.1", "lessThan": "43.4.4", "versionType": "semver"}, {"status": "unaffected", "version": "43.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "42.68.1", "lessThan": "42.96.3", "versionType": "semver"}, {"status": "unaffected", "version": "42.96.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "42.68.1", "lessThan": "43.4.4", "versionType": "semver"}, {"status": "unaffected", "version": "43.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "42.68.1", "lessThan": "42.96.3", "versionType": "semver"}, {"status": "unaffected", "version": "42.96.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "42.68.1", "lessThan": "43.4.4", "versionType": "semver"}, {"status": "unaffected", "version": "43.4.4", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "13.3.0", "lessThan": "13.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "13.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "13.3.0", "lessThan": "13.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "13.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "13.3.0", "lessThan": "13.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "13.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "13.3.0", "lessThan": "13.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "13.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "13.3.0", "lessThan": "13.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "13.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "13.3.0", "lessThan": "13.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "13.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "13.3.0", "lessThan": "13.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "13.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "13.3.0", "lessThan": "13.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "13.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "renovatebot", "product": "renovate", "versions": [{"status": "affected", "version": "13.3.0", "lessThan": "13.6.0", "versionType": "semver"}, {"status": "unaffected", "version": "13.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-19T14:17:49.307", "references": [{"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposure", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Undergoing Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-526"}]}], "descriptions": [{"lang": "en", "value": "Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment."}], "lastModified": "2026-09-08T20:28:37.587", "sourceIdentifier": "disclosure@vulncheck.com"}