High severity8.0NVD Advisory· Published Aug 28, 2026

CVE-2026-82282

Description

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Runatlantis/Atlantisreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=0.47.1

Patches

Vulnerability mechanics

References

github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.gonvd
github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.gonvd
github.com/runatlantis/atlantis/issues/6622nvd
www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callersnvd

News mentions

No linked articles in our index yet.

cvss	0.520
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000