CVE-2026-76227: Cleartext Storage of Sensitive Information in an Environment Variable in renovatebot renovate

Renovate versions 42.68.1 up to but not including 42.96.3, versions 43.0.0 up to but not including 43.4.4, and Mend Renovate CE/EE images from 13.3.0 up to but not including 13.6.0 fail to restrict environment variables to an allowlist when spawning child processes. Consequently, child processes such as npm install, postUpgradeTasks, and postUpdateOptions inherit full access to all environment variables of the parent Renovate process. This behavior can lead to the exposure of sensitive information stored in environment variables to insider or external attackers who can execute or influence these child processes.

The vulnerability allows child processes spawned by Renovate to access all environment variables of the Renovate process, which may include sensitive secrets. This can lead to the exfiltration of confidential information accessible to the Renovate deployment. The attack vector requires local or insider access with limited privileges and does not require user interaction. The vulnerability does not affect confidentiality, integrity, or availability beyond the exposure of environment variables.

A fix is available in Renovate versions 42.96.3 and later, 43.4.4 and later, and Mend Renovate CE/EE versions 13.6.0 and later. Users should upgrade to these versions to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.