Vulnerability Description
Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/runatlantis/atlantis
- https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29
- https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29
- https://github.com/runatlantis/atlantis/issues/6622
- https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-
FAQ
What is CVE-2026-82282?
CVE-2026-82282 is a vulnerability with a CVSS score of 8.0 (HIGH). Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirec...
How severe is CVE-2026-82282?
CVE-2026-82282 has been rated HIGH with a CVSS base score of 8.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82282?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.