What is CVE-2026-82282?

CVE-2026-82282 is a high-severity vulnerability in Runatlantis Atlantis, classified under Missing Authentication for Critical Function. CVSS score: 8.0/10. Published 2026-08-28.

How severe is CVE-2026-82282?

High severity. CVSS v3 base score is 8.0 out of 10.

Auth bypass in Runatlantis Atlantis

CVE-2026-82282

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N.

Affected products

Runatlantis Atlantis

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-82282?: CVE-2026-82282 is a high-severity vulnerability in Runatlantis Atlantis, classified under Missing Authentication for Critical Function. CVSS score: 8.0/10. Published 2026-08-28.
How severe is CVE-2026-82282?: High severity. CVSS v3 base score is 8.0 out of 10.