Atlantis Exposes Service Version Publicly on /status API Endpoint

Vulnerability

Overview

CVE-2025-58445 describes an information disclosure vulnerability in Atlantis, a self-hosted Go application that automates Terraform workflows via pull request webhooks. The /status endpoint, intended as a health check, returns detailed version and build information without requiring authentication [1][2]. This violates security best practices that recommend minimizing exposed metadata.

Exploitation

An attacker can simply issue a GET request to http:///status to retrieve the version string. No authentication or special network position is required. The disclosed version can then be cross-referenced with public vulnerability databases (e.g., NVD) to identify known flaws in that specific release [2]. This lowers the barrier for targeted attacks.

Impact

The vulnerability is classified as information disclosure. While it does not directly allow code execution, it enables attackers to tailor exploits based on the exact version of Atlantis and its dependencies. This could lead to broader compromise if the underlying software has exploitable vulnerabilities [2]. All versions of Atlantis are affected, and no fix is currently available [1][2].

Mitigation

As of the publication date, there is no patch. Administrators are advised to restrict access to the /status endpoint using network-level controls (e.g., firewall rules or reverse proxy authentication) until an official fix is released [2]. The issue is tracked in the project's GitHub repository [3].