CVE-2026-76227— Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
Quick assessment
Affected
renovatebot renovate
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Renovate Bot Renovate是Renovate Bot组织的一个自动化依赖更新工具。 Renovate Bot Renovate 42.68.1至42.96.3之前版本和42.68.1至43.4.4之前版本存在加密问题漏洞，该漏洞源于生成子进程时未将环境变量限制在允许列表中，导致子进程获得Renovate进程所有环境变量的完全访问权限，可能允许内部或外部攻击者窃取Renovate部署可访问的机密信息。
Possible ATT&CK Techniques 1 AI
T1003 · OS Credential DumpingAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| mend | renovate-ce | 13.3.0< 13.6.0 |
affected |
13.6.0 |
unaffected | ||
| mend | renovate-ee-server | 13.3.0< 13.6.0 |
affected |
13.6.0 |
unaffected | ||
| mend | renovate-ee-worker | 13.3.0< 13.6.0 |
affected |
13.6.0 |
unaffected | ||
| renovatebot | renovate | 42.68.1< 42.96.3 |
affected |
42.96.3 |
unaffected | ||
43.0.0< 43.4.4 |
affected | ||
43.4.4 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76227
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure
Source: CVE Program / CVE List V5
Vulnerability Description
Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过环境变量导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
Renovate Bot Renovate 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Renovate Bot Renovate是Renovate Bot组织的一个自动化依赖更新工具。 Renovate Bot Renovate 42.68.1至42.96.3之前版本和42.68.1至43.4.4之前版本存在加密问题漏洞，该漏洞源于生成子进程时未将环境变量限制在允许列表中，导致子进程获得Renovate进程所有环境变量的完全访问权限，可能允许内部或外部攻击者窃取Renovate部署可访问的机密信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| renovatebot | renovate | 42.68.1 ~ 42.96.3 | - |
|
| mend | renovate-ce | 13.3.0 ~ 13.6.0 | - |
|
| mend | renovate-ee-server | 13.3.0 ~ 13.6.0 | - |
|
| mend | renovate-ee-worker | 13.3.0 ~ 13.6.0 | - |
|
II. Public POCs for CVE-2026-76227
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76227
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-76227 (2)
Same Patch Batch · renovatebot · 2026-08-19 · 11 CVEs total
| CVE-2019-25766 | 7.5 HIGH | Renovate before 19.38.7 Credential Exposure via Go Modules |
| CVE-2020-37267 | 7.5 HIGH | Renovate 19.180.0 before 23.25.1 Token Leakage via Logs |
| CVE-2026-76229 | 6.7 MEDIUM | Renovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomize |
| CVE-2026-76230 | 6.7 MEDIUM | Renovate 35.63.0 before 40.33.0 Command Injection via npm |
| CVE-2026-76233 | 6.7 MEDIUM | Renovate 39.53.0 before 40.33.0 Command Injection via gleam manager |
| CVE-2026-76228 | 6.7 MEDIUM | Renovate before 42.68.5 Remote Code Execution via Gradle Wrapper |
| CVE-2026-76232 | 6.7 MEDIUM | Renovate 31.51.0 before 40.33.0 Command Injection via helmv3 |
| CVE-2026-76231 | 6.7 MEDIUM | Renovate 32.135.0 before 40.33.0 Command Injection via hermit |
| CVE-2024-58376 | 6.7 MEDIUM | Renovate 37.158.0 before 37.199.0 Command Injection via helmv3 |
| CVE-2026-76226 | 6.3 MEDIUM | Renovate 43.65.0 before 43.102.11 Remote Code Execution via lockFileMaintenance |
IV. Related Vulnerabilities
Same product: renovate
-
CVE-2026-88889
Renovate before 44.14.7 Command Injection via distributionTy -
CVE-2026-88888
Renovate before 44.14.7 Command Injection via Mix organizati -
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Hea -
CVE-2026-88886
Renovate before 44.14.7 Command Injection via gradle-wrapper -
CVE-2026-88885
Renovate before 44.14.7 Command Injection via depName
Same vendor: renovatebot
-
CVE-2026-88889
Renovate before 44.14.7 Command Injection via distributionTy -
CVE-2026-88888
Renovate before 44.14.7 Command Injection via Mix organizati -
CVE-2026-88887
Renovate before 44.11.2 Credential Exfiltration via Link Hea -
CVE-2026-88886
Renovate before 44.14.7 Command Injection via gradle-wrapper -
CVE-2026-88885
Renovate before 44.14.7 Command Injection via depName
Same weakness: CWE-526
-
CVE-2026-108592
mini-swe-agent 1.10.0 through 2.4.6 Environment Exposure via -
CVE-2026-72648
Cleartext Storage of Sensitive Information in an Environment -
CVE-2026-49377
JetBrains TeamCity 安全漏洞 -
CVE-2026-45370
python-utcp: Full Process Environment Exposed to CLI Subproc -
CVE-2026-40153
PraisonAIAgents Affected by Environment Variable Secret Exfi
V. Comments for CVE-2026-76227
No comments yet