Cpe:2.3:a:runatlantis:atlantis:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3arunatlantisatlantis/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 20:04:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAtlantis: Command injection via atlantis.yaml workspace parameter (CVE-2026-116676)https://feed.craftedsignal.io/briefs/2026-10-atlantis-command-injection/Tue, 27 Oct 2026 20:04:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-atlantis-command-injection/Atlantis versions 0.4.0 through 0.47.0 contain a command injection vulnerability where shell metacharacters in the workspace parameter can trigger arbitrary code execution as the service account.Atlantis versions 0.4.0 through 0.47.0 are vulnerable to command injection through the workspace value defined in the atlantis.yaml configuration file. This vulnerability arises because the workspace parameter is improperly sanitized before being included in a Terraform command argument joined and executed via sh -c. An authenticated contributor can inject shell metacharacters into the workspace name to execute arbitrary commands with the privileges of the Atlantis service account. This allows for potential access to sensitive environment variables, cloud provider credentials, and Terraform state files. The issue is addressed in version 0.47.1.

Impact

Successful exploitation allows for arbitrary command execution as the Atlantis service user. This provides access to the process environment, including cloud-provider and version-control credentials, Terraform state files, and internal network resources reachable from the host.

Recommendation

  • Upgrade Atlantis to version 0.47.1 or later immediately.
  • Audit atlantis.yaml configurations in existing repositories for suspicious or unconventional workspace names.
  • Evaluate the risk of the --allow-fork-prs flag; disable this option if not strictly required to mitigate exposure to external contributors.
  • Monitor the Atlantis service process for the execution of child processes that deviate from the expected Terraform workflow.
]]>highadvisory