CVE-2026-82282

Sažetak

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

Reference

https://github.com/runatlantis/atlantis
https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go
https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go
https://github.com/runatlantis/atlantis/issues/6622
https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers

CVSS

Base:	8.0
Impact:	5.8
Exploitability:	1.6

Pristup

Vektor	Složenost	Autentikacija
NETWORK	HIGH	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
HIGH	HIGH	NONE

CVSS vektor

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Zadnje važnije ažuriranje

31-08-2026 - 19:17

Objavljeno

28-08-2026 - 20:20