Atlantis EUVD-2026-67813

Three conditions must coincide for exploitation: the Atlantis instance must be configured to use GitHub App authentication (the /github-app/setup endpoint is only relevant to this authentication mode-token-based deployments are unaffected); the attacker must have network-level access to the Atlantis HTTP management interface at the time of exploitation; and an administrator must be actively performing the GitHub App installation or reconfiguration flow, since the vulnerable endpoint is only traversed during that setup sequence and not during normal operation. The CVSS 4.0 AT:P metric confirms a specific attack prerequisite condition. Exploitation is not possible in steady-state operation after setup is complete unless an administrator re-initiates the setup flow. Deployments behind a private network or VPN with no public exposure significantly reduce the realistic attack surface despite the AV:N metric.

The CVSS 4.0 score of 8.8 (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N) is well-calibrated: the high attack complexity and prerequisite attack condition (AC:H/AT:P) reflect that exploitation requires temporal alignment with an active administrator setup session, not an always-on attack surface. This meaningfully constrains opportunistic mass exploitation-the window exists only during initial GitHub App configuration or reconfiguration. The passive user interaction metric (UI:P) confirms an administrator must trigger the setup flow for the endpoint to be traversable in its vulnerable state. Despite these constraints, the impact side of the vector is accurate: VC:H/VI:H on the vulnerable system and SC:H/SI:H on the subsequent system (GitHub) mean a successful attacker gains persistent, cryptographically legitimate access to all repositories under the GitHub App installation. No CISA KEV listing is present and no EPSS data was provided in source intelligence, so widespread automated exploitation is not confirmed-but the severity of credential compromise makes this a priority for any team with a publicly accessible Atlantis management interface, regardless of organization size. The absence of a public POC is a partial mitigating signal, not a reason to defer patching.

An attacker with network access to a publicly exposed Atlantis instance monitors HTTP traffic or directly polls the /github-app/setup endpoint. When an administrator initiates or re-runs the GitHub App installation flow, the attacker makes an unauthenticated GET request to /github-app/setup during the OAuth redirect sequence and receives the RSA private key and webhook secret in the response. The attacker then uses the RSA key to sign JWTs and mint GitHub App installation tokens, gaining API access to all repositories under the App installation, and uses the webhook secret to forge HMAC-signed payloads that trigger unauthorized Terraform plan or apply operations.