CVE-2026-76227
Description
A flaw was found in Renovate. The application fails to restrict environment variables when it creates new child processes. This oversight allows these child processes, such as those used for package installation or post-upgrade tasks, to access all environment variables of the main Renovate process. Consequently, an attacker, whether internal or external, could exploit this to steal sensitive information or secrets from the Renovate deployment.
Statement
This Moderate-impact information disclosure flaw in Renovate allows child processes to access all environment variables, potentially exposing sensitive data. Exploitation requires local access to the Renovate deployment. Red Hat's konflux-ci/mintmaker-renovate-image is not affected by this vulnerability as the vulnerable code is not present.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
