CVE-2026-76227 Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
Attackers can exfiltrate secrets from environment variables because child processes inherit all variables without restriction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76227?
CVE-2026-76227 is a medium-severity vulnerability in mend renovate, published on 19 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
Weakness: CWE-526
Which versions are affected by CVE-2026-76227?
4 open source packages ship an affected version, including renovate.
| Package | Affected | Fixed in |
|---|---|---|
renovate npm | From 42.68.1 | 42.96.3 |
renovate npm | From 42.68.1 | 42.96.3 |
renovate npm | From 43.0.0 | 43.4.4 |
renovate npm | From 43.0.0 | 43.4.4 |
How do I fix CVE-2026-76227?
Upgrade renovate to a fixed version for your release line: 42.96.3 or 43.4.4.
Is CVE-2026-76227 being exploited?
There is no known exploitation of CVE-2026-76227 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-BQ28777, GHSA-8wc6-vgrq-x6cf, GHSA-p44v-39mg-jgrj.