Environment-variable allowlist bypass in Renovate by Renovatebot and Mend Renovate products

Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset. Attackers controlling an externally sourced preset can override variables like PATH, LD_PRELOAD, NODE_OPTIONS, or GIT_SSL_CAINFO in child processes on self-hosted instances.

• renovatebot/renovate: affected from version 0 to less than 44.60.1; the confirmed patched version is 44.60.1.
• mend/renovate-ce, mend/renovate-ee-server, and mend/renovate-ee-worker: affected from version 0 to less than 15.5.0; the confirmed patched version is 15.5.0.
• Helm chart mend-renovate-ce: affected from version 0 to less than 15.5.0; the confirmed patched version is 15.5.0.
• Helm chart mend-renovate-enterprise-edition: affected from version 0 to less than 10.5.0; the confirmed patched version is 10.5.0.
• These boundaries apply to the branches and products listed in the record and advisory. The status of other branches should remain unknown unless separately confirmed.

When Renovate invokes external commands, it uses an allowlist to determine which environment variables are passed to the child process. A self-hosted administrator controls part of this behavior through the allowedEnv configuration, while a repository can specify env when permitted by that configuration. The vulnerability occurs because placing env inside a shared preset can bypass the check applied to repository configuration. If an externally controlled preset is consumed, it can set or override variables such as PATH, LD_PRELOAD, NODE_OPTIONS, and GIT_SSL_CAINFO. The vendor identifies exposure conditions that include a self-hosted instance, restricted environment-variable policy, repositories using presets, and a preset that specifies env. This is an Incorrect Authorization weakness, CWE-863. Public sources do not describe the exact configuration merge or validation path involved.

The attack path is through configuration and preset processing by a self-hosted instance, rather than through a standalone unauthenticated service. The supplied assessment describes network reachability, low required privileges, low attack complexity, and no user interaction, with an additional precondition that the attacker-controlled or attacker-supplied preset must be consumed by the deployment. The vendor advisory notes that additional information about the environment would be needed for a targeted attack. The supplied record marks public_exploit as false and known_exploited as null; no confirmed exploitation status is provided by the sources reviewed.

The direct technical outcome is that a child process launched by Renovate may receive environment variables that the administrator intended to exclude. PATH, LD_PRELOAD, NODE_OPTIONS, and GIT_SSL_CAINFO can change executable resolution, library loading, Node.js startup behavior, or Git certificate validation. Because child processes commonly run with the worker's permissions and access to its data, abuse could affect confidentiality, integrity, or availability within that reachable scope. The record does not establish that the flaw always produces host takeover, secret theft, or arbitrary code execution. The concrete impact depends on the preset consumed, the child command invoked, and the permissions of the self-hosted instance.

• An untrusted shared preset can influence the execution environment of child commands launched by self-hosted Renovate, changing the behavior of automation.
• Variables such as PATH, LD_PRELOAD, NODE_OPTIONS, and GIT_SSL_CAINFO can affect executable resolution, library loading, Node.js startup behavior, or Git TLS validation. The actual result depends on the child command, worker permissions, and accessible data.
• Under suitable conditions, this can create confidentiality, integrity, or availability risk within the execution environment and the resources accessible to the worker.
• The available sources do not confirm credential theft, arbitrary code execution, or host compromise. Those are possible consequences, not established outcomes.

1. Upgrade the renovatebot/renovate package, image, or deployment to 44.60.1.
2. Upgrade Mend renovate-ce, renovate-ee-server, and renovate-ee-worker to 15.5.0.
3. Upgrade the mend-renovate-ce Helm chart to 15.5.0 and the mend-renovate-enterprise-edition Helm chart to 10.5.0.
4. Recheck inventory after upgrading to verify that every worker, server, image, and chart is running a patched version, rather than updating only one control-plane component.
5. The vendor advisory states that no workaround is available. While upgrades are pending, treat external shared presets as untrusted and review presets containing env; this is temporary risk reduction, not a substitute for patching.
6. After updating, review repositories and presets previously processed by affected deployments for unexpected configuration changes.

1. Inventory self-hosted instances, container images, npm packages, and Helm charts, then compare each deployment with the affected and patched boundaries.
2. Identify deployments using allowedEnv to restrict environment variables, because this is directly relevant to the vendor's exposure conditions.
3. Enumerate shared presets used by repositories, especially presets loaded from external sources, and inspect them for an env entry.
4. Review recent changes to preset sources and unexpected environment values in child-process telemetry from Renovate runs. This is precautionary monitoring, not a published indicator of compromise.
5. Do not treat the absence of suspicious logs as proof of safety. Confirm exposure through version inventory and patch verification.