CVE-2026-64679

HighCVSS 8.1

Published: 21/08/2026(UTC)Updated: 25/08/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

Atlantis versions 0.19.8 through 0.45.0 do not consistently validate user-controlled workspace values. This can allow escaping the intended workspace directory and performing filesystem operations outside it, leading to integrity loss or DoS.

Risk Assessment

An attacker can create, delete, or overwrite files on the system with the privileges of the Atlantis process, potentially causing data corruption or downtime.

Recommendation

Update Atlantis to version 0.45.0 or later, which includes the fix.

Other vulnerabilities in Atlantis

CVE-2026-82282High
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

Original NVD description (English source)

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.