Runatlantis vulnerabilities
We track 6 vulnerabilities in Runatlantis products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Runatlantis vulnerabilities
- 8.8 High severity
atlantis: Improper Neutralization of Special Elements used in an OS Command
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are
- 8.0 High severity
atlantis: Missing Authentication for Critical Functionality
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook sec
- 8.1 High severity
atlantis: Improper Limitation of a Pathname to a Restricted Directory
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yam
- 7.5 High severity
atlantis: Exposure of Sensitive Information to an Unauthorized Actor
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to i
- 9.8 Critical severity
atlantis: Insertion of Sensitive Information into Log File
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlant
- 7.5 High severity
github.com/runatlantis/atlantis/server/controll…: Observable Discrepancy
The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an atta