CVE-2026-116676: Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Atlantisto a version that resolves this vulnerability.Fixed in 0.47.1
Event History
Frequently Asked Questions
Which contributors can exploit this issue?
Any authenticated contributor whose pull request is eligible for an Atlantis plan can exploit it from a same-repository branch. Contributors using fork pull requests can do so only if Atlantis is started with --allow-fork-prs enabled.
Is a custom workflow, apply access, or a malicious Terraform provider required?
No. Exploitation occurs during an Atlantis plan using a pull-request-controlled workspace value, and does not require custom workflows, apply permission, or a malicious provider.
What could an attacker access after successful exploitation?
Commands run as the Atlantis service account and inherit its process environment. They can access cloud-provider, Terraform, and version-control credentials, along with files, Terraform state, and network resources available to that account.
Which versions should be remediated?
Atlantis versions from 0.4.0 through 0.47.1 are affected according to the provided data. Update to the fixed version 0.47.1.