Live › vulnerability › CVE-2026-116676
Go to dashboardAtlantis passes the workspace value from a pull request's atlantis.yaml into a shell command without escaping, so shell metacharacters execute. An authenticated contributor whose pull request is eligible for a plan can run arbitrary commands as the Atlantis service account and reach its cloud, Terraform and version-control credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 18:32 UTC. All times on this page are UTC.
Teams that self-host Atlantis to run Terraform plans from pull requests are affected, since the flaw lives in how the workspace value from atlantis.yaml reaches the shell. Anyone who can open a pull request Atlantis will plan, including same-repository branches, can trigger it; fork pull requests matter only if --allow-fork-prs is enabled. Teams on 0.47.1 or later, or not running Atlantis, can skip it.
No product ranges from the sources yet.
atlantis version, or the image tag in your deployment, and see whether it is between 0.4.0 and 0.47.1.--allow-fork-prs in the Atlantis server flags; same-repository branches are exposed regardless.0.47.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-116676")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.