CVE-2026-64679
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
Atlantis versions 0.19.8 through 0.45.0 do not consistently validate user-controlled workspace values. This can allow escaping the intended workspace directory and performing filesystem operations outside it, leading to integrity loss or DoS.
Risk Assessment
An attacker can create, delete, or overwrite files on the system with the privileges of the Atlantis process, potentially causing data corruption or downtime.
Recommendation
Update Atlantis to version 0.45.0 or later, which includes the fix.
Other vulnerabilities in Atlantis
See all- CVE-2026-116676High
Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join and executed through sh -c. An authenticated contributor can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account. The issue is fixed in version 0.47.1.
- CVE-2026-82282High
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.
Original NVD description (English source)
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS