CVE-2026-82282

HIGH 8.0

Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

CVSS Score

8.0

EPSS Score

0.0%

EPSS Percentile

0th

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

CWE	CWE-306
Vendor	runatlantis
Product	atlantis
Published	Aug 28, 2026

Stay Ahead of the Next One

Get instant alerts for runatlantis atlantis

Be the first to know when new high vulnerabilities affecting runatlantis atlantis are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

runatlantis / atlantis

0 ≤ 0.47.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/runatlantis/atlantis/issues/6622 github.com: https://github.com/runatlantis/atlantis github.com: https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go github.com: https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go vulncheck.com: https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers

Credits

🔍 George Chen