# CVE-2026-76227: Renovate improper access control in child process environment variables

Source: https://junglewise.ai/threats/cve-2026-76227-renovate-improper-access-control-in-child-process-environment  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76227 · Severity: medium · CVSS 5.5 · Published 2026-08-19

Renovate, a popular automated dependency update tool, inadvertently exposed all of its environment variables to child processes (such as npm install and custom post-upgrade tasks). This could allow both internal and external attackers to extract sensitive credentials and API tokens that Renovate uses for repository and dependency management. Organizations using affected versions should rotate all credentials that Renovate has access to.

Technologies: [Mend Renovate-Ce](https://junglewise.ai/threats/technologies/renovate-ce), [Mend Renovate-Ee-Server](https://junglewise.ai/threats/technologies/renovate-ee-server), [Mend Renovate-Ee-Worker](https://junglewise.ai/threats/technologies/renovate-ee-worker). Vendors: [Mend](https://junglewise.ai/threats/vendors/mend).

## Quick answers

**Is CVE-2026-76227 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76227 being exploited in the wild.

**How severe is CVE-2026-76227?** Medium severity, with a CVSS score of 5.5, published 19 August 2026.

**Which products and versions are affected?** Mend Renovate-Ce >=13.3.0 <13.6.0; Mend Renovate-Ee-Server >=13.3.0 <13.6.0; Mend Renovate-Ee-Worker >=13.3.0 <13.6.0.

**Is there a fix for CVE-2026-76227?** A patch was published on 2026-02-13: Patches released in 42.96.3 and 43.4.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76227 attacked?** It is attacked with local access or from the adjacent network, in a software library.

**Am I affected by CVE-2026-76227?** Check whether you run Mend Renovate-Ce, Mend Renovate-Ee-Server or Mend Renovate-Ee-Worker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper access control issue (CWE-269) in environment variable handling. Since version 42.68.1 (2025-12-30), Renovate removed filtering that previously restricted child process access to a whitelist of environment variables. This occurred when the codebase migrated to the execa library, whose default behavior extends environment variables rather than overriding them—a change missed during code review. Child processes spawned for tasks like npm install, postUpgradeTasks, and postUpdateOptions now receive all environment variables accessible to the Renovate process. The attack requires local or adjacent access to the child process or the ability to influence its execution (low privilege requirement, no user interaction needed). Patches are available in versions 42.96.3 and 43.4.4.

## Affected products

- Renovate Renovate >=42.68.1 <42.96.3, >=43.0.0 <43.4.4
- Mend renovate-ce >=13.3.0 <13.6.0
- Mend renovate-ee-server >=13.3.0 <13.6.0
- Mend renovate-ee-worker >=13.3.0 <13.6.0

## Identifiers

- CVE-2026-76227
- GHSA-8wc6-vgrq-x6cf

## Timeline

- 2026-02-13: disclosed: GHSA-8wc6-vgrq-x6cf published
- 2026-02-13: patched: Patches released in 42.96.3 and 43.4.4

## References

- [https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf](https://github.com/renovatebot/renovate/security/advisories/GHSA-8wc6-vgrq-x6cf)
- [https://github.com/renovatebot/renovate](https://github.com/renovatebot/renovate)

## Related threats

- [Renovate server-side request forgery in HTTP presets](https://junglewise.ai/threats/cve-2026-110868-renovate-before-44-79-0-contains-a-server-side-request-forgery)
- [Renovate environment variable allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110867-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate protection mechanism bypass in minimumReleaseAge checks](https://junglewise.ai/threats/cve-2026-110866-renovate-before-44-61-3-contains-a-protection-mechanism-bypass)
- [Renovate HTTP header allowlist bypass in shared presets](https://junglewise.ai/threats/cve-2026-110865-renovate-before-44-60-1-contains-an-allowlist-bypass)
- [Renovate command injection in Maven Wrapper manager](https://junglewise.ai/threats/cve-2026-88889-renovate-command-injection-in-maven-wrapper-manager)