CVE-2026-82282CWE-306

CVE-2026-82282

High · published August 29, 2026

CVSS v3.1
8.0
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00439 · 37.2th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-08-29T00:20Z
References (5)
https://github.com/runatlantis/atlantis · [email protected]https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go · [email protected]https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go · [email protected]https://github.com/runatlantis/atlantis/issues/6622 · [email protected]https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 16:19Z
    Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers
    cvelistv5