Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Renovatebot
  • Renovate

No data.

No data.

References
Link Providers
https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf cve-icon cve-icon
https://www.vulncheck.com/advisories/renovate-before-environment-variable-exposure cve-icon cve-icon
History

Tue, 25 Aug 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 20 Aug 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Renovatebot
Renovatebot renovate
Vendors & Products Renovatebot
Renovatebot renovate

Wed, 19 Aug 2026 14:15:00 +0000

Type Values Removed Values Added
Description Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
Title Renovate 42.68.1 before 42.96.3 Environment Variable Exposure
Weaknesses CWE-526
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-08-19T14:02:09.384Z

Updated: 2026-08-25T01:58:19.515Z

Reserved: 2026-08-19T11:36:02.573Z

Link: CVE-2026-76227

cve-icon Vulnrichment

Updated: 2026-08-25T01:58:15.464Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-19T14:17:49.307

Modified: 2026-09-08T20:28:37.587

Link: CVE-2026-76227

cve-icon Redhat

No data.