Atlantis CVE-2026-116676

Exploitation requires that Atlantis processes the atlantis.yaml from the pull-request branch and that the attacker's pull request is eligible to run an Atlantis plan. The concrete prerequisite is control over the project 'workspace' value in atlantis.yaml (or the -w flag), which is validated only against '..', '/', and '\' and therefore permits shell metacharacters such as ';', '#', '$', redirections and whitespace. It does NOT require custom workflows, allow_custom_workflows, apply permission, or a malicious Terraform provider. Limiting factors: the attacker must be an authenticated contributor (PR:L) with an eligible PR; external/fork contributors can reach the flaw only when the server has --allow-fork-prs enabled, while eligible same-repository branches do not need that flag. Public repositories with --allow-fork-prs are the most exposed deployments.

This is a genuine high-priority issue, not a CVSS-inflated one. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) is internally consistent with the mechanism: a network-reachable webhook flow, low attack complexity (a single crafted workspace string in atlantis.yaml), and PR:L correctly reflecting that the attacker must be an authenticated contributor whose pull request is eligible for a plan. The impact rating C:H/I:H/A:H is well supported because command execution occurs as the Atlantis service account with access to cloud-provider, Terraform, and VCS credentials. The vuln.today Decision label is 'this_week', indicating prompt but not emergency remediation. No EPSS score and no CISA KEV entry were supplied, so there is no evidence of active or widespread exploitation; absence of these signals is not evidence of safety but means exploitation is not confirmed in the wild. A detailed, reproducible proof-of-concept is published in the GHSA advisory itself, which materially raises real-world likelihood versus a theoretical bug. The main factor reducing universal urgency is the precondition that an attacker needs an eligible pull request - external/fork exploitation requires --allow-fork-prs, though same-repository branches do not. Net: a real priority for anyone running Atlantis with contributor-facing PR automation, especially public repositories with fork PRs enabled.

A contributor opens a pull request containing an atlantis.yaml whose project 'workspace' field embeds shell metacharacters (e.g. 'poc;id;false;#') and comments 'atlantis plan'. When Atlantis runs the plan, it joins the Terraform arguments and executes them through sh -c, so the injected commands run as the Atlantis service account and can read the cloud/Terraform/VCS credentials in its environment. A working proof-of-concept demonstrating this is published in the vendor's GHSA advisory; for external/fork contributors the attack requires --allow-fork-prs, whereas an eligible same-repository branch does not.