{"id":"CVE-2026-82282","state":"PUBLISHED","title":"Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers","description":"Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.","publishedAt":"2026-08-28T16:19:01.750Z","updatedAt":"2026-09-24T14:20:12.233Z","severity":{"score":8.8,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["runatlantis atlantis"],"affected":[{"vendor":"runatlantis","product":"atlantis","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.47.1","versionType":"semver"}]}],"references":["https://github.com/runatlantis/atlantis/issues/6622","https://github.com/runatlantis/atlantis","https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go","https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go","https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:13:15.269Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/82xxx/CVE-2026-82282.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-82282","state":"PUBLISHED","datePublished":"2026-08-28T16:19:01.750Z","dateUpdated":"2026-09-24T14:20:12.233Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-08-28T11:12:51.276Z"},"containers":{"cna":{"title":"Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers","descriptions":[{"lang":"en","value":"Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery."}],"affected":[{"vendor":"runatlantis","product":"atlantis","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"0.47.1","versionType":"semver"}]}],"references":[{"url":"https://github.com/runatlantis/atlantis/issues/6622","tags":["issue-tracking"],"name":"GitHub Issue #6622"},{"url":"https://github.com/runatlantis/atlantis","tags":["product"]},{"url":"https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go","tags":["technical-description"],"name":"Vulnerable code: github_app_controller.go"},{"url":"https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go","tags":["technical-description"],"name":"Vulnerable code: middleware.go"},{"url":"https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers","name":"VulnCheck Advisory: Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","baseScore":8.8,"baseSeverity":"HIGH"}},{"format":"CVSS","cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","lang":"en","description":"Missing Authentication for Critical Function","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-09-24T14:20:12.233Z"},"datePublic":"2026-07-02T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:runatlantis:atlantis:*:*:*:*:*:*:*:*","versionEndIncluding":"0.47.1"}]}]}],"credits":[{"lang":"en","value":"George Chen","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-08-31T16:23:29.082800Z","id":"CVE-2026-82282","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-31T18:54:51.164Z"}}]}}}