---
id: CVE-2026-76227
title: >-
  Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before
  43.4.4), including corresponding Docker images (renovate/renovate,
  mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0),
  fail to restrict enviro…
summary: >-
  Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before
  43.4.4), including corresponding Docker images (renovate/renovate,
  mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0),
  fail to restrict enviro…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-526
published: '2026-08-19'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:28:37.587'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-76227'
references:
  - url: >-
      https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposure
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00116
epssPercentile: 0.01792
ingestedAt: '2026-09-08T21:11:12.284Z'
---

## Overview

Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.