CVE-2026-76227 affects Renovate versions starting at 42.68.1 up to but not including 42.96.3 and 43.4.4, as well as related Docker images (renovate/renovate, mend/renovate-ce, renovate-ee-server, renovate-ee-worker versions >=13.3.0 <13.6.0). The issue arises because Renovate fails to restrict environment variables to an allowlist when spawning child processes such as npm install or postUpgradeTasks. Consequently, these child processes inherit full access to all environment variables of the parent Renovate process, which may include sensitive secrets. This can enable insider or external attackers with access to child processes to exfiltrate sensitive information.

Child processes spawned by vulnerable Renovate versions can access all environment variables of the Renovate process, potentially exposing sensitive secrets stored in environment variables. This exposure could lead to unauthorized disclosure of sensitive information within the deployment environment. The vulnerability requires at least low privileges (local access) to exploit and does not involve user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to Renovate deployments and child processes to trusted users only. Avoid running Renovate in environments where sensitive environment variables could be exposed to untrusted child processes.