CVE-2026-76228: Renovate Gradle Wrapper RCE Vulnerability

CVE-2026-76228 Overview

CVE-2026-76228 is a command injection vulnerability [CWE-78] affecting Renovate versions >=32.124.0 and before 42.68.5, as well as Mend renovate-ce/renovate-ee before 13.3.0. The flaw exists in how Renovate processes Gradle Wrapper updates. Renovate invokes the wrapper update command through a shell using /bin/sh -c ... ./gradlew :wrapper --gradle-distribution-url <value>. An attacker who commits a malicious gradle-wrapper.properties file containing shell substitution syntax such as $(...) in the distributionUrl triggers arbitrary command execution in the Renovate runtime. The vulnerability executes even when the allowScripts option is disabled.

Critical Impact
Attackers who can introduce a crafted gradle-wrapper.properties file into a repository scanned by Renovate achieve arbitrary command execution in the Renovate process context.

Affected Products

Renovate >=32.124.0 and <42.68.5
Mend renovate-ce before 13.3.0
Mend renovate-ee before 13.3.0

Discovery Timeline

2026-08-19 - CVE-2026-76228 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76228

Vulnerability Analysis

Renovate automates dependency updates across many ecosystems, including Gradle projects. When it handles a Gradle Wrapper update, it constructs a shell command that passes the distributionUrl value from gradle-wrapper.properties as an argument to ./gradlew :wrapper --gradle-distribution-url. The command runs through /bin/sh -c, which performs command substitution on any $(...) expression before Gradle receives the argument. Because Renovate does not sanitize or quote the URL value before shell invocation, attacker-controlled content in distributionUrl executes as a shell subprocess. The injected command runs in the Renovate runtime, which typically holds credentials for source repositories and package registries. The allowScripts: false configuration provides no protection because the injection occurs in Renovate's own wrapper handling logic rather than in Gradle build scripts.

Root Cause

The root cause is unsafe construction of a shell command string using untrusted repository content. Renovate passes the distributionUrl field directly into a /bin/sh -c invocation without escaping shell metacharacters. This pattern maps to [CWE-78]: Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

An attacker must place a malicious gradle-wrapper.properties into a repository that Renovate scans. This can occur through a direct commit by a repository contributor, a pull request from a fork in configurations where Renovate processes untrusted PRs, or compromise of an upstream dependency source. Once Renovate parses the file during a Gradle Wrapper update run, the crafted distributionUrl triggers shell command substitution and executes the attacker's payload. Exploitation requires privileged access to influence repository content but no user interaction on the Renovate host.

See the GitHub Security Advisory and the VulnCheck Advisory on Renovate for additional technical detail.

Detection Methods for CVE-2026-76228

Indicators of Compromise

Presence of shell substitution syntax such as $(...) or backticks inside the distributionUrl value of any gradle-wrapper.properties file in scanned repositories.
Unexpected child processes spawned by the Renovate process, particularly shells, curl, wget, or reverse shell binaries during Gradle Wrapper update runs.
Outbound network connections from Renovate workers to hosts not associated with Gradle distributions or configured package registries.

Detection Strategies

Scan repository content for gradle-wrapper.properties files whose distributionUrl does not match the expected https://services.gradle.org/distributions/ pattern.
Enable process auditing on Renovate hosts and alert on sh -c invocations containing shell metacharacters in argument positions where URLs are expected.
Review Renovate job logs for wrapper update steps that produce unexpected output or errors around the --gradle-distribution-url argument.

Monitoring Recommendations

Baseline the process tree and network destinations of Renovate workers, then alert on deviations during Gradle-related jobs.
Ingest CI/CD and Renovate runtime logs into a centralized analytics platform for correlation with repository change events.
Track outbound DNS and HTTP requests from Renovate execution environments and flag connections to newly observed or low-reputation hosts.

How to Mitigate CVE-2026-76228

Immediate Actions Required

Upgrade Renovate to 42.68.5 or later, and Mend renovate-ce/renovate-ee to 13.3.0 or later.
Audit all repositories scanned by Renovate for gradle-wrapper.properties files containing $(...), backticks, or other shell metacharacters in distributionUrl.
Rotate credentials and tokens accessible from the Renovate runtime if compromise is suspected.

Patch Information

The fix is available in Renovate 42.68.5 and Mend renovate-ce/renovate-ee13.3.0. Patch details are published in the GitHub Security Advisory GHSA-pfq2-hh62-7m96. Apply the update to all self-hosted Renovate deployments and confirm the running version matches the fixed release.

Workarounds

Disable Gradle Wrapper updates in the Renovate configuration until the patched version is deployed.
Restrict Renovate to scan only trusted repositories and reject pull requests from forks that modify gradle-wrapper.properties.
Run Renovate in an isolated, ephemeral environment with minimal credentials and no persistent write access to production systems.

bash

# Renovate configuration example: disable Gradle Wrapper manager as a temporary workaround
{
  "enabledManagers": ["npm", "pip_requirements", "dockerfile"],
  "gradle-wrapper": {
    "enabled": false
  }
}