CVE-2026-82282highCWE-306

CVE-2026-82282: fallo de gravedad alta en runatlantis atlantis

Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear atlantis

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.4%
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Productos afectados
runatlantis · atlantis
CVEs relacionadas — runatlantis atlantis

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-64679HIGHAtlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/CreationEPSS 0.8%CVE-2024-52009HIGHGit credentials are exposed in atlantis logsEPSS 0.7%CVE-2026-116676HIGHAtlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planEPSS 0.5%CVE-2025-58445MEDIUMAtlantis Exposes Service Version Publicly on /status API EndpointEPSS 0.5%