CVE-2026-76227
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
renovate
- Vendor
- renovatebot
- Product
- renovate
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 42.68.1 | affected | semver | 42.96.3 | Unavailable | None listed |
| 42.96.3 | unaffected | semver | Unavailable | Unavailable | None listed |
| 43.0.0 | affected | semver | 43.4.4 | Unavailable | None listed |
| 43.4.4 | unaffected | semver | Unavailable | Unavailable | None listed |
renovate-ce
- Vendor
- mend
- Product
- renovate-ce
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 13.3.0 | affected | semver | 13.6.0 | Unavailable | None listed |
| 13.6.0 | unaffected | semver | Unavailable | Unavailable | None listed |
renovate-ee-server
- Vendor
- mend
- Product
- renovate-ee-server
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 13.3.0 | affected | semver | 13.6.0 | Unavailable | None listed |
| 13.6.0 | unaffected | semver | Unavailable | Unavailable | None listed |
renovate-ee-worker
- Vendor
- mend
- Product
- renovate-ee-worker
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 13.3.0 | affected | semver | 13.6.0 | Unavailable | None listed |
| 13.6.0 | unaffected | semver | Unavailable | Unavailable | None listed |