CVE-2026-76226: Renovate RCE Vulnerability in Bazel Managers

CVE-2026-76226 Overview

CVE-2026-76226 is a remote code execution vulnerability in Renovate, the automated dependency update tool. The flaw affects the bazel-module and bazelisk managers when the lockFileMaintenance feature is enabled. Attackers who control a referenced dependency can execute arbitrary code by injecting malicious content into bazel mod deps calls, such as inside ctx.execute statements. The vulnerability affects Renovate versions from 43.65.0 before 43.102.11. The issue is tracked as [CWE-78] OS Command Injection and was disclosed through the Renovate GitHub Security Advisory.

Critical Impact
Malicious dependencies processed during lock file maintenance can execute arbitrary code within the Renovate runner, compromising CI/CD pipelines and any secrets accessible to the bot.

Affected Products

Renovate 43.65.0 through versions before 43.102.11
Renovate bazel-module manager with lockFileMaintenance enabled
Renovate bazelisk manager with lockFileMaintenance enabled

Discovery Timeline

2026-08-19 - CVE-2026-76226 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-76226

Vulnerability Analysis

Renovate scans repositories for outdated dependencies and opens pull requests to update them. When lockFileMaintenance runs against Bazel projects, Renovate invokes Bazel commands including bazel mod deps to resolve the current module graph. Bazel evaluates Starlark repository rules during this resolution, which can include ctx.execute calls that spawn subprocesses.

The vulnerability arises because Renovate executes these commands against untrusted repository content without sandboxing dependency-controlled logic. A dependency referenced by the target repository can supply Starlark code that Bazel executes on the Renovate host during the maintenance run. The advisory identifies the issue as OS command injection [CWE-78].

Root Cause

The root cause is trust placed in transitive Bazel module dependencies during automated lock file maintenance. Renovate's bazel-module and bazelisk managers invoke Bazel's module resolution, which fetches and evaluates external dependencies. Malicious dependencies can embed arbitrary shell commands in ctx.execute calls, and Bazel runs them as part of normal resolution.

Attack Vector

An attacker publishes or controls a Bazel module referenced directly or transitively by a repository monitored by Renovate. When lockFileMaintenance triggers a scheduled update, Renovate calls bazel mod deps, which pulls and evaluates the attacker-controlled module. The embedded ctx.execute payload runs on the Renovate worker with the privileges of the Renovate process, including access to Git credentials, tokens, and any secrets mounted into the CI environment. The CVSS 4.0 vector lists Local attack vector with high privilege requirements, reflecting that exploitation requires the Renovate job to process the malicious dependency.

No verified public exploit code is available. See the VulnCheck Security Advisory for additional technical detail.

Detection Methods for CVE-2026-76226

Indicators of Compromise

Unexpected child processes spawned by bazel or bazelisk during Renovate maintenance runs.
Outbound network connections from Renovate workers to hosts unrelated to configured registries.
New or modified files in the Renovate workspace outside expected lock file paths.
Renovate job logs containing shell output from ctx.execute invocations referencing unknown scripts.

Detection Strategies

Inventory all Renovate deployments and confirm the running version against 43.102.11 or later.
Audit repository configurations for lockFileMaintenance enabled alongside bazel-module or bazelisk managers.
Enable process auditing on Renovate runners to capture parent-child relationships around Bazel invocations.
Review Bazel MODULE.bazel files and lock files for dependencies from untrusted registries or unexpected sources.

Monitoring Recommendations

Ship Renovate runner logs and process telemetry to a central SIEM for correlation across builds.
Alert on non-Bazel binaries executed as children of bazel or bazelisk processes.
Monitor CI/CD secret access patterns for anomalies during scheduled Renovate windows.

How to Mitigate CVE-2026-76226

Immediate Actions Required

Upgrade Renovate to version 43.102.11 or later across all self-hosted deployments.
Verify Mend-hosted Renovate installations reflect the patched release before re-enabling maintenance jobs.
Rotate any credentials or tokens exposed to Renovate workers that ran vulnerable versions with lockFileMaintenance.
Review recent pull requests generated by Renovate for the bazel-module or bazelisk managers for unexpected changes.

Patch Information

The fix is available in Renovate 43.102.11. Details are published in the Renovate GitHub Security Advisory GHSA-5vjq-5jmg-39xq. Self-hosted operators should update container images, npm installations, or the Renovate CLI depending on their deployment model.

Workarounds

Disable lockFileMaintenance for repositories using the bazel-module or bazelisk managers until patching is complete.
Restrict Renovate runners to network egress destinations required for approved registries only.
Run Renovate jobs in ephemeral, isolated containers with minimal secret exposure.
Pin Bazel module dependencies to trusted sources and review transitive dependencies before enabling automation.

bash

# Configuration example: disable lockFileMaintenance for Bazel managers
# renovate.json
{
  "bazel-module": {
    "lockFileMaintenance": { "enabled": false }
  },
  "bazelisk": {
    "lockFileMaintenance": { "enabled": false }
  }
}