CVE-2026-76227mediumCWE-526

CVE-2026-76227: falha de média gravidade em renovatebot renovate

Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar renovate+ Monitorar renovate-ce

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.8epss 0.2%
Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images (renovate-ce, renovate-ee-server, renovate-ee-worker) from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when spawning child processes. As a result, child processes (e.g. npm install, postUpgradeTasks, postUpdateOptions) gain full access to all environment variables of the Renovate process, allowing insider or outside attackers to exfiltrate secrets accessible to the Renovate deployment.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
mend · renovate-cemend · renovate-ee-servermend · renovate-ee-workerrenovatebot · renovate
CVEs relacionadas — renovatebot renovate

No mesmo produto, das mais perigosas para as menos.

CVE-2026-88889HIGHRenovate before 44.14.7 Command Injection via distributionTypeEPSS 1.0%CVE-2026-76228HIGHRenovate before 42.68.5 Remote Code Execution via Gradle WrapperEPSS 1.0%CVE-2026-88888HIGHRenovate before 44.14.7 Command Injection via Mix organizationEPSS 0.9%CVE-2026-88885HIGHRenovate before 44.14.7 Command Injection via depNameEPSS 0.9%CVE-2026-88880CRITICALRenovate before 44.11.3 Credential Exfiltration via Link HeaderEPSS 0.5%CVE-2026-88887CRITICALRenovate before 44.11.2 Credential Exfiltration via Link HeaderEPSS 0.4%