EUVD-2026-67813
GHSA-r4h6-8wpf-fw98
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires active admin setup session (AC:H/UI:R); credential theft crosses GitHub's trust boundary (S:C); no availability impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.
AnalysisAI
The /github-app/setup endpoint in Atlantis through 0.47.1 is completely unauthenticated, exposing GitHub App credentials-including the RSA private key and webhook secret-to any network caller who reaches the endpoint during a setup session. Successful exploitation grants an attacker the ability to mint valid GitHub App installation tokens and forge webhook payloads, effectively compromising the trust chain between Atlantis and all GitHub repositories managed through that App installation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must coincide for exploitation: the Atlantis instance must be configured to use GitHub App authentication (the /github-app/setup endpoint is only relevant to this authentication mode-token-based deployments are unaffected); the attacker must have network-level access to the Atlantis HTTP management interface at the time of exploitation; and an administrator must be actively performing the GitHub App installation or reconfiguration flow, since the vulnerable endpoint is only traversed during that setup sequence and not during normal operation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.8 (AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N) is well-calibrated: the high attack complexity and prerequisite attack condition (AC:H/AT:P) reflect that exploitation requires temporal alignment with an active administrator setup session, not an always-on attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No patched release version is confirmed in the available intelligence-the referenced source files (github_app_controller.go commit 12bfa59f) point to a code-level fix location but no tagged release is identified. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately audit all Atlantis deployments (version ≤0.47.1) with internet exposure and block external network access to the /github-app/setup endpoint using firewall rules, WAF policies, or reverse proxy configuration; check GitHub App audit logs for unauthorized token generation or webhook activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Rated high sev
Path traversal in Atlantis workspace handling (versions 0.19.8 through 0.44.x) allows authenticated users to escape the
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in t
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Rated medium s
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today