CVE-2026-76227— Renovate 42.68.1 before 42.96.3 Environment Variable Exposure
Quick assessment
Affected
renovatebot renovate
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Renovate 42.68.1 至 42.96.3（不含 42.96.3）以及 42.68.1 至 43.4.4（不含 43.4.4）的版本中，包括相应的 Docker 镜像（renovate/renovate、mend/renovate-ce、renovate-ee-server、renovate-ee-worker，版本范围为 >=13.3.0 且 <13.6.0），在启动子进程时未能将环境变量限制为白名单。因此，子进程（例如 npm install、postUpgradeTasks、postUpdate
Possible ATT&CK Techniques 1 AI
T1003 · OS Credential DumpingAffected Version Matrix 34
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| renovatebot | renovate | 42.68.1< 42.96.3 |
affected |
42.96.3 |
unaffected | ||
42.68.1< 43.4.4 |
affected | ||
43.4.4 |
unaffected | ||
42.68.1< 42.96.3 |
affected | ||
42.96.3 |
unaffected | ||
42.68.1< 43.4.4 |
affected | ||
43.4.4 |
unaffected | ||
| … +26 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76227
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Renovate 42.68.1 before 42.96.3 Environment Variable Exposure
Source: CVE Program / CVE List V5
Vulnerability Description
Renovate versions from 42.68.1 before 42.96.3 (and from 42.68.1 before 43.4.4), including corresponding Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker >=13.3.0 <13.6.0), fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过环境变量导致的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| renovatebot | renovate | 42.68.1 ~ 42.96.3 | - |
|
| renovatebot | renovate | 42.68.1 ~ 43.4.4 | - |
|
| renovatebot | renovate | 42.68.1 ~ 42.96.3 | - |
|
| renovatebot | renovate | 42.68.1 ~ 43.4.4 | - |
|
| renovatebot | renovate | 42.68.1 ~ 42.96.3 | - |
|
| renovatebot | renovate | 42.68.1 ~ 43.4.4 | - |
|
| renovatebot | renovate | 42.68.1 ~ 42.96.3 | - |
|
| renovatebot | renovate | 42.68.1 ~ 43.4.4 | - |
|
| renovatebot | renovate | 13.3.0 ~ 13.6.0 | - |
|
| renovatebot | renovate | 13.3.0 ~ 13.6.0 | - |
|
| renovatebot | renovate | 13.3.0 ~ 13.6.0 | - |
|
| renovatebot | renovate | 13.3.0 ~ 13.6.0 | - |
|
| renovatebot | renovate | 13.3.0 ~ 13.6.0 | - |
|
| renovatebot | renovate | 13.3.0 ~ 13.6.0 | - |
|
| renovatebot | renovate | 13.3.0 ~ 13.6.0 | - |
|
| renovatebot | renovate | 13.3.0 ~ 13.6.0 | - |
|
| renovatebot | renovate | 13.3.0 ~ 13.6.0 | - |
|
II. Public POCs for CVE-2026-76227
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76227
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76227 (2)
Same Patch Batch · renovatebot · 2026-08-19 · 11 CVEs total
| CVE-2024-58376 | 8.8 HIGH | Renovate 37.158.0 before 37.199.0 Command Injection via helmv3 |
| CVE-2019-25766 | 7.5 HIGH | Renovate before 19.38.7 Credential Exposure via Go Modules |
| CVE-2020-37267 | 7.5 HIGH | Renovate 19.180.0 before 23.25.1 Token Leakage via Logs |
| CVE-2026-76229 | 6.7 MEDIUM | Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize |
| CVE-2026-76230 | 6.7 MEDIUM | Renovate 35.63.0 before 40.33.0 Command Injection via npm |
| CVE-2026-76233 | 6.7 MEDIUM | Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager |
| CVE-2026-76228 | 6.7 MEDIUM | Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper |
| CVE-2026-76232 | 6.7 MEDIUM | Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 |
| CVE-2026-76231 | 6.7 MEDIUM | Renovate 32.135.0 before 40.33.0 Command Injection via hermit |
| CVE-2026-76226 | 6.3 MEDIUM | Renovate 43.65.0 through 43.102.11 Remote Code Execution via lockFileMaintenance |
IV. Related Vulnerabilities
Same product: renovate
-
CVE-2026-76233
Renovate 39.53.0 before 40.33.0 Command Injection via gleam -
CVE-2026-76232
Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 -
CVE-2026-76231
Renovate 32.135.0 before 40.33.0 Command Injection via hermi -
CVE-2026-76230
Renovate 35.63.0 before 40.33.0 Command Injection via npm -
CVE-2026-76229
Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection
Same vendor: renovatebot
-
CVE-2026-76233
Renovate 39.53.0 before 40.33.0 Command Injection via gleam -
CVE-2026-76232
Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 -
CVE-2026-76231
Renovate 32.135.0 before 40.33.0 Command Injection via hermi -
CVE-2026-76230
Renovate 35.63.0 before 40.33.0 Command Injection via npm -
CVE-2026-76229
Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection
Same weakness: CWE-526
-
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment -
CVE-2026-49377
JetBrains TeamCity 安全漏洞 -
CVE-2026-45370
python-utcp: Full Process Environment Exposed to CLI Subproc -
CVE-2026-40153
PraisonAIAgents Affected by Environment Variable Secret Exfi -
CVE-2025-36105
IBM Planning Analytics Advanced Certified Containers is vuln
V. Comments for CVE-2026-76227
No comments yet