CVE-2026-64679: Atlantis Path Traversal Vulnerability

CVE-2026-64679 Overview

CVE-2026-64679 is a path traversal vulnerability [CWE-22] in Atlantis, a self-hosted Go application that processes Terraform pull request events through webhooks. Versions from 0.19.8 up to (but not including) 0.45.0 fail to consistently validate user-controlled workspace values supplied through repository-level atlantis.yaml configuration or authenticated /api/plan requests. Attackers with permission to submit these inputs can inject traversal segments that escape the intended per-pull workspace directory. The flaw allows filesystem operations such as os.RemoveAll and os.MkdirAll to execute on arbitrary paths with the privileges of the Atlantis process.

Critical Impact
Authenticated users can create, delete, or reuse writable directories outside the intended workspace, causing data integrity loss or denial of service on the Atlantis host.

Affected Products

Atlantis versions 0.19.8 through 0.44.x
Self-hosted Atlantis deployments accepting repository-level atlantis.yaml configuration
Atlantis instances exposing the authenticated /api/plan endpoint

Discovery Timeline

2026-08-21 - CVE-2026-64679 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-64679

Vulnerability Analysis

Atlantis constructs per-pull-request working directories by joining user-supplied workspace names into local filesystem paths. The pre-patch code accepted workspace strings containing .. sequences or path separators (/, \) without rejecting them. When Atlantis prepared a clone or manipulated a working directory, it invoked filesystem operations such as os.RemoveAll and os.MkdirAll on the composed path before Terraform ever validated the workspace name. The traversal segments caused these operations to target directories outside the intended scope. Because the Atlantis process typically runs with elevated privileges to manage clones and Terraform state, an attacker who can influence workspace inputs can delete or overwrite writable paths anywhere the process user has access.

Root Cause

The root cause is missing input validation on workspace identifiers in two ingress points: the atlantis.yaml project configuration parsed from repositories, and the authenticated HTTP /api/plan handler. Both accepted arbitrary strings and forwarded them into filepath.Join-style composition without stripping or rejecting traversal metacharacters.

Attack Vector

Exploitation requires authenticated access sufficient to open a pull request containing a crafted atlantis.yaml, or to invoke the /api/plan API. The attacker supplies a workspace value such as ../../etc/somepath. When Atlantis reaches the working-directory preparation stage, it calls os.RemoveAll or os.MkdirAll against the resolved out-of-bounds path, mutating the filesystem before Terraform rejects the invalid workspace.

The upstream fix rejects traversal metacharacters at parse time:

validWorkspace := func(value any) error {
    strPtr := value.(*string)
    if strPtr == nil || *strPtr == "" {
        return nil
    }
    ws := *strPtr
    if strings.Contains(ws, "..") || strings.ContainsAny(ws, "/\\") {
        return errors.New("cannot contain '..', '/', or '\\'")
    }
    return nil
}

A companion patch hardens repository owner and name parsing in server/events/models/models.go:

if strings.Contains(repo, "/") {
    return Repo{}, fmt.Errorf("invalid repo format %q, repo %q should not contain any /'s", repoFullName, owner)
}
if strings.Contains(owner, "..") || strings.Contains(repo, "..") {
    return Repo{}, fmt.Errorf("invalid repo format %q, owner or repo cannot contain '..'", repoFullName)
}

Source: GitHub Commit ea4e4ce

Detection Methods for CVE-2026-64679

Indicators of Compromise

atlantis.yaml files in pull requests containing workspace: values with .., /, or \ characters
HTTP requests to /api/plan with workspace parameters containing traversal sequences
Unexpected RemoveAll or MkdirAll calls in Atlantis logs referencing paths outside the configured data directory
Missing or truncated directories in the Atlantis working data path

Detection Strategies

Inspect Atlantis application logs for workspace names containing traversal metacharacters prior to Terraform validation errors
Audit repository atlantis.yaml history for suspicious workspace values across monitored repositories
Enable filesystem auditing (auditd, Falco) on the Atlantis data directory to flag writes outside expected subpaths

Monitoring Recommendations

Alert on Atlantis process filesystem activity targeting paths above the configured --data-dir
Track pull request events that trigger plan failures immediately following clone preparation errors
Monitor the running Atlantis version and flag any instance below 0.45.0

How to Mitigate CVE-2026-64679

Immediate Actions Required

Upgrade Atlantis to version 0.45.0 or later on all self-hosted deployments
Restrict who can submit atlantis.yaml changes and invoke /api/plan to trusted users only
Run the Atlantis process under a dedicated low-privilege service account with a scoped data directory
Review recent pull requests and API activity for workspace values containing .., /, or \

Patch Information

The fix is included in Atlantis v0.45.0 via pull request #6254 and commit ea4e4ce. Full advisory details are documented in GHSA-26w5-6g95-gj28 and the v0.45.0 release notes.

Workarounds

Disable repository-level atlantis.yaml overrides by enforcing a server-side configuration until patched
Restrict network access to the /api/plan endpoint via reverse proxy allowlisting
Isolate the Atlantis process using containers or systemd unit hardening (ReadOnlyPaths, ProtectSystem=strict) to limit filesystem reach

bash

# Upgrade Atlantis container image to the patched release
docker pull ghcr.io/runatlantis/atlantis:v0.45.0

# Restart Atlantis with a scoped data directory and least-privilege user
atlantis server \
  --data-dir=/var/lib/atlantis \
  --disable-repo-locking=false \
  --allow-repo-config=false