CVE-2026-82282
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.
Risk Assessment
The risk includes full compromise of the GitHub App, potentially leading to unauthorized actions in repositories and integrity violation of CI/CD processes.
Recommendation
Immediately update Atlantis to a patched version and implement authentication for the /github-app/setup endpoint. Also rotate keys and secrets if compromise is suspected.
Other vulnerabilities in Atlantis
Original NVD description (English source)
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.