High severity · published Sep 6, 2025
CVE-2025-58445
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
Atlantis · Runatlantis
through 0.35.1 · source: NVD
Affected product
AT
Atlantis
Runatlantis
More from Atlantis
9.8
CVE-2024-52009
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks
8.8
CVE-2026-116676
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
8.1
CVE-2026-64679
Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation
8.0
CVE-2026-82282
Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers
7.5
CVE-2022-24912
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a…