CVE-2026-82282

Received Received - Intake

Atlantis GitHub App Credential Exposure via Unauthenticated Setup Endpoint

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82282

EUVD

EUVD-2026-67813

Affected Vendors & Products

Vendor	Product	Version / Range
atlantis	atlantis	to 0.47.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint. This allows unauthenticated attackers to access GitHub App credentials by observing or intercepting the GitHub redirect during setup. Attackers can obtain the RSA private key and webhook secret, enabling them to forge installation tokens and manipulate webhook payloads.

Detection Guidance

Check for unauthorized access to the /github-app/setup endpoint by monitoring HTTP requests to this path. Look for unauthenticated GET or POST requests that return GitHub App credentials. Review server logs for suspicious activity around this endpoint, particularly failed authentication attempts or unexpected credential exposure.

Impact Analysis

Attackers could gain unauthorized access to your GitHub App, forge installation tokens to interact with repositories, and manipulate webhook payloads to inject malicious code or exfiltrate data. This could lead to data breaches, unauthorized repository access, or compromised CI/CD pipelines.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data breaches or unauthorized data exposure.

Mitigation Strategies

Upgrade Atlantis to a version that fixes this vulnerability. If an upgrade is not immediately available, restrict access to the /github-app/setup endpoint by configuring network firewalls or web application firewalls to block external access. Monitor for any signs of credential compromise and revoke exposed GitHub App credentials.

Hi! I’m here to help you understand CVE-2026-82282. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70