CVE-2026-82282: Atlantis Auth Bypass Vulnerability

CVE-2026-82282 Overview

CVE-2026-82282 is a missing authentication vulnerability [CWE-306] in Atlantis, an open-source Terraform pull request automation tool. Versions through 0.47.1 fail to authenticate the /github-app/setup endpoint. Unauthenticated attackers who observe or intercept the GitHub redirect during setup can retrieve the GitHub App RSA private key and webhook secret. With these credentials, attackers can mint installation tokens and forge webhook payloads. This gives them the ability to impersonate the Atlantis GitHub App and manipulate repositories connected to the affected instance.

Critical Impact
Exposure of GitHub App credentials enables token minting and webhook forgery against every repository the app is installed on.

Affected Products

Atlantis versions through 0.47.1
Deployments exposing the /github-app/setup endpoint to untrusted networks
GitHub App integrations configured via the Atlantis setup flow

Discovery Timeline

2026-08-28 - CVE-2026-82282 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82282

Vulnerability Analysis

Atlantis exposes an HTTP handler at /github-app/setup used during first-time GitHub App provisioning. GitHub redirects the administrator back to this endpoint after app creation, delivering the generated RSA private key and webhook secret in the response. In affected versions the handler is not protected by the authentication middleware. Any unauthenticated caller who can reach the endpoint at the moment GitHub returns credentials, or who can intercept the redirect, receives the same secrets.

Once an attacker obtains the RSA private key and webhook secret, they can generate signed JSON Web Tokens (JWTs) to request GitHub App installation tokens. Installation tokens grant the permissions configured for the Atlantis GitHub App, which typically include read and write access to pull requests, repository contents, and checks. Forged webhook payloads signed with the leaked secret can trigger Atlantis to plan or apply Terraform changes on attacker-controlled input.

Root Cause

The root cause is missing authorization on a credential-issuing endpoint. The github_app_controller.go handler returns sensitive setup material without verifying the requester, and the middleware in middleware.go does not gate the setup route. This corresponds to [CWE-306: Missing Authentication for a Critical Function].

Attack Vector

Exploitation requires network reach to the Atlantis server and either passive interception of the GitHub setup redirect or the ability to poll the endpoint during app registration. Attackers on the same network path, a compromised proxy, or a shared logging pipeline can capture the redirect URL and its parameters. Because the endpoint does not require authentication, direct requests during the setup window also return the credentials.

Refer to the VulnCheck Security Advisory and GitHub Issue #6622 for endpoint behavior and reproduction notes.

Detection Methods for CVE-2026-82282

Indicators of Compromise

Unexpected requests to /github-app/setup from external or non-administrator IP addresses in Atlantis access logs.
GitHub audit log entries showing installation tokens minted from unfamiliar IPs or user agents.
Webhook deliveries to Atlantis originating from sources other than GitHub's published IP ranges.
Unplanned Terraform plan or apply operations triggered without a corresponding pull request event.

Detection Strategies

Review Atlantis HTTP logs for any GET requests to /github-app/setup outside of a known provisioning window.
Correlate GitHub App installation token requests with expected Atlantis server IPs and alert on deviations.
Validate webhook signatures against a rotated secret and log verification failures for investigation.

Monitoring Recommendations

Forward Atlantis and reverse proxy access logs to a centralized analytics platform for query and alerting.
Monitor GitHub organization audit logs for integration_installation_token.create events and unusual API activity.
Alert on Atlantis workflows that execute without an associated pull request comment or webhook lineage.

How to Mitigate CVE-2026-82282

Immediate Actions Required

Restrict network access to the Atlantis /github-app/setup endpoint to trusted administrator networks until upgrade.
Rotate the GitHub App RSA private key and webhook secret if the endpoint was ever reachable from untrusted networks.
Review GitHub audit logs for unauthorized installation token creation and revoke suspicious tokens.
Audit recent Terraform plan and apply activity for changes not tied to legitimate pull requests.

Patch Information

At the time of publication, the Atlantis repository tracks the fix in GitHub Issue #6622. Upgrade to a release later than 0.47.1 that authenticates the /github-app/setup route, and re-run GitHub App setup only after upgrading. Review the affected github_app_controller.go and middleware.go sources when validating patched behavior.

Workarounds

Place Atlantis behind an authenticating reverse proxy that requires administrator credentials for /github-app/setup.
Terminate TLS at a trusted edge and block the setup path from the public internet using firewall or ingress rules.
Perform GitHub App registration only from an isolated network and immediately rotate credentials after setup completes.

bash

# Example nginx snippet restricting the setup endpoint to an admin CIDR
location /github-app/setup {
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://atlantis_backend;
}