Login Request a demo
High severity · published Aug 28, 2026
CVE-2026-82282
Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers
8.0
CVSS
0.4%
EPSS
No
On KEV
Description
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AT
atlantis · runatlantis
through 0.47.1 · source: vendor
Affected product
AT
atlantis
runatlantis
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82282
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82282
github.com
https://github.com/runatlantis/atlantis
github.com
https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go
github.com
https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go
github.com
https://github.com/runatlantis/atlantis/issues/6622
www.vulncheck.com
https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers
More from atlantis
9.8
CVE-2024-52009
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks
8.8
CVE-2026-116676
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
8.1
CVE-2026-64679
Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation
7.5
CVE-2025-58445
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks
7.5
CVE-2022-24912
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a…