Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76227Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure

Medium 5.5

In plain English

A medium-severity security flaw in renovate-ce from mend. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.2%top 95.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	renovate	42.96.3	GHSA-8wc6-vgrq-x6cf
npm	renovate	43.4.4	GHSA-8wc6-vgrq-x6cf

Affected products (as reported)

Vendor	Product	Versions
renovatebot	renovate	42.68.1 – before 42.96.343.0.0 – before 43.4.4
mend	renovate-ce	13.3.0 – before 13.6.0
mend	renovate-ee-server	13.3.0 – before 13.6.0
mend	renovate-ee-worker	13.3.0 – before 13.6.0

Weakness: CWE-526 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-8wc6-vgrq-x6cf) vendor-advisory
VulnCheck Advisory: Renovate 42.68.1 before 42.96.3 Environment Variable Exposure third-party-advisory