TI-2026-81450 CVE-2026-116676 · GHSA-rjh2-4xgw-p2hj
OS command injection in Atlantis via pull request workspace name
Priority HIGH 73
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.
runatlantis
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9
Exploited now
runatlantis records in CISA KEVNo runatlantis vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2026-46224 CVE-2026-64679 · GHSA-26w5-6g95-gj28
Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation
Priority HIGH 70
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.
TI-2025-36203 CVE-2025-58445 · GHSA-xh7v-965r-23f7
Atlantis Exposes Service Version Publicly on /status API Endpoint
Priority HIGH 70
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.
TI-2026-56747 CVE-2026-82282 · GHSA-r4h6-8wpf-fw98
Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers
Priority LOW 38
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials.
TI-2024-34896 CVE-2024-52009 · GHSA-gppm-hq3p-h4rp
Git credentials are exposed in atlantis logs
Priority LOW 38
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.
TI-2022-08720 CVE-2022-24912 · GHSA-jxqv-jcvh-7gr4
Timing Attack
Priority LOW 35
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate…