CVE-2026-82282

CVE-2026-82282 is a missing-authentication flaw (CWE-306) in Atlantis, the open-source Terraform pull-request automation server, affecting all releases through 0.47.1: the /github-app/setup endpoint performs no authentication. An unauthenticated attacker who can reach the endpoint during the GitHub App setup flow can observe or intercept the redirect to GitHub and thereby obtain the GitHub App's RSA private key and webhook secret. With those credentials the attacker can mint GitHub App installation tokens carrying the app's repository permissions and forge webhook payloads, which is why the CVSS 4.0 base score of 8.8 (High) includes high impact on subsequent systems, i.e., the connected GitHub repositories. Any organization running Atlantis through 0.47.1 is affected, particularly servers reachable by untrusted users or exposed to the internet; per the CVSS 4.0 vector (AT:P/UI:P), practical exploitation hinges on the setup-redirect scenario rather than trivial unauthenticated access at any time. There is no public proof of concept, no CISA KEV listing, and no known in-the-wild exploitation; EPSS estimates a 0.3% (18th percentile) probability of exploitation within 30 days.

What to do: Upgrade Atlantis to a release newer than 0.47.1 as soon as a patched version is published (no fixed version number is given in the available advisory data). In the meantime, restrict access to the Atlantis server and specifically the /github-app/setup endpoint to trusted users, for example by blocking or gating that path at a reverse proxy or firewall, and avoid internet-exposing the instance. If exposure is suspected, rotate the GitHub App private key and webhook secret and review GitHub audit logs for unexpected installation tokens or webhook activity.