CVE-2026-82282
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.
Risk Assessment
The risk includes full compromise of the GitHub App, potentially leading to unauthorized actions in repositories and integrity violation of CI/CD processes.
Recommendation
Immediately update Atlantis to a patched version and implement authentication for the /github-app/setup endpoint. Also rotate keys and secrets if compromise is suspected.
Other vulnerabilities in Atlantis
See all- CVE-2026-116676High
Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join and executed through sh -c. An authenticated contributor can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account. The issue is fixed in version 0.47.1.
- CVE-2026-64679High
Atlantis versions 0.19.8 through 0.45.0 do not consistently validate user-controlled workspace values. This can allow escaping the intended workspace directory and performing filesystem operations outside it, leading to integrity loss or DoS.
Original NVD description (English source)
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS