Zero Radar
← feed
HighVulnerabilityCVE-2026-116676updated 27 Oct 2026, 21:05 UTC

Atlantis: pull request can run commands on the server via workspace name

A person who can open a pull request in a repository using Atlantis can hide system commands inside the workspace name. Atlantis then runs those commands on its server, with the server's access to cloud and repository credentials.

Fixed in 0.47.1Official, 2 sources
SeverityHighCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes0.47.1 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Contributor opens PRWorkspace name in atlantis.yaml contains shell syntax
  2. 2Atlantis reads configOnly blocks .. / and backslash
  3. 3Command built as stringArguments joined with spaces, no escaping
  4. 4Run via sh -cInjected commands execute on the server
  5. 5Credentials exposedProcess environment includes cloud and VCS secrets
  6. ResultAttacker runs commands as the Atlantis service account

What happened

Atlantis builds Terraform commands by joining arguments into a string and running it via sh -c, without escaping the pull-request-controlled workspace value from atlantis.yaml. Shell metacharacters in the workspace name lead to arbitrary command execution as the Atlantis service account.

Why it is dangerous: Commands run with the Atlantis process environment, which commonly holds cloud-provider, Terraform, and version-control credentials, plus access to files, state and network resources. Anyone who can open a qualifying pull request could gain control of that account.

Are you affected?

You are affected if you run Atlantis version 0.4.0 through 0.47.0 and any contributor can open a pull request eligible for an Atlantis plan, including same-repository branches; external fork pull requests are reachable only when --allow-fork-prs is enabled.

Package / productAffected versionsFixed in
github.com/runatlantis/atlantis · go>= 0.4.0, <= 0.47.00.47.1

What to do

  1. Upgrade Atlantis to version 0.47.1 or later
  2. Rotate cloud-provider, Terraform, and version-control credentials available to the Atlantis process if it ran a vulnerable version with untrusted pull requests
  3. Keep --allow-fork-prs disabled unless you need it

Timeline

  1. 27 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 18:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 21:05 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 21:05 UTC
    Fixed version published: github.com/runatlantis/atlantis 0.47.1 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116676 · GHSA-rjh2-4xgw-p2hj
CVSS
8.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 18:17 UTC
On Zero Radar
27 Oct 2026, 18:20 UTC (3 min after disclosure)
Last change
27 Oct 2026, 21:05 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Atlantis: pull request can run commands on the server via workspace name · Zero Radar