Environment Variable Exposure in Renovate by Renovae

CVE-2026-76227

What is CVE-2026-76227?

The Renovate product in its versions from 42.68.1 to prior to 42.96.3 (including corresponding Docker images) is susceptible to a vulnerability where it fails to properly restrict environment variables while spawning child processes. This oversight allows any child processes, such as npm install and other upgrade tasks, to gain unrestricted access to the environment variables of the Renovate process. Consequently, this vulnerability presents an opportunity for both insiders and external attackers to exfiltrate sensitive secrets contained within the Renovate deployment.

References