Atlantis Exposes Service Version Publicly on /status API Endpoint
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| runatlantis | atlantis | up to 0.35.1 | — | No fix listed | CNA |
| — | github.com/runatlantis/atlantis (Go) | up to 0.35.1 | — | No fix listed | GHSA-xh7v-965r-23f7 |
- atlantis Vendorrunatlantis Affected up to 0.35.1 Fixed in — No fix listed CNA
- github.com/runatlantis/atlantis (Go) Vendor— Affected up to 0.35.1 Fixed in — No fix listed GHSA-xh7v-965r-23f7
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:runatlantis:atlantis:*:*:*:*:*:*:*:* | up to 0.35.1 | Vulnerable | runatlantis |
- cpe:2.3:a:runatlantis:atlantis:*:*:*:*:*:*:*:* Versions up to 0.35.1 Vulnerable ·runatlantis
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58445
- 2026-10-03 Alias added: GHSA-xh7v-965r-23f7
References
More runatlantis Atlantis vulnerabilities
- TI-2024-34896 Git credentials are exposed in atlantis logs CVSS 4.0HIGH 8.5
- TI-2022-08720 Timing Attack CVSS 3.1HIGH 7.5
Sources
- CVE-2025-58445 · CVE Program
- CVE-2025-58445 · NVD
- FIRST EPSS
- GHSA-xh7v-965r-23f7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences