Runatlantis Atlantis
5 CVEs affecting Runatlantis Atlantis. Latest disclosed: 2026-08-28. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-52009 | Critical | 9.8 | 2024-11-08 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `gh… |
CVE-2026-64679 | High | 8.1 | 2026-08-21 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consisten… |
CVE-2026-82282 | High | 8.0 | 2026-08-28 | Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers ca… |
CVE-2025-58445 | High | 7.5 | 2025-09-06 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed ver… |
CVE-2022-24912 | High | 7.5 | 2022-07-29 | The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which… |