TI-2026-81450 CVE-2026-116676 · GHSA-rjh2-4xgw-p2hj
OS command injection in Atlantis via pull request workspace name
Priority HIGH 73
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.
Vulnerabilities
6 records
TI-2026-56747 CVE-2026-82282 · GHSA-r4h6-8wpf-fw98
Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers
Priority LOW 38
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials.
TI-2026-46224 CVE-2026-64679 · GHSA-26w5-6g95-gj28
Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation
Priority HIGH 70
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.
TI-2025-36203 CVE-2025-58445 · GHSA-xh7v-965r-23f7
Atlantis Exposes Service Version Publicly on /status API Endpoint
Priority HIGH 70
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.
TI-2024-34896 CVE-2024-52009 · GHSA-gppm-hq3p-h4rp
Git credentials are exposed in atlantis logs
Priority LOW 38
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.
TI-2022-08720 CVE-2022-24912 · GHSA-jxqv-jcvh-7gr4
Timing Attack
Priority LOW 35
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate…