CVE-2026-76227: Renovate 42.68.1 before 42.96.3 Environment Variable Exposure
Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 42.96.3 - Upgrade
Upgrade
Renovateto a version that resolves this vulnerability.Fixed in 43.4.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments running Renovate 42.68.1 through versions before 42.96.3, or 42.68.1 through versions before 43.4.4, are affected. The affected Docker images include renovate/renovate, mend/renovate-ce, renovate-ee-server, and renovate-ee-worker versions 13.3.0 through before 13.6.0.
What does an attacker need to exploit this issue?
An attacker needs a way to cause or control a child process run by Renovate, such as through npm install, postUpgradeTasks, or postUpdateOptions. The attack can be performed by an insider or an outside attacker and may expose secrets available in Renovate's process environment.
What secrets could be exposed?
Any environment variable accessible to the Renovate process can be inherited by its child processes because the variables are not restricted to an allowlist. The provided information does not identify specific variable names or secret types.