CVE-2026-82282: Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers

Q: Which deployments are exposed?

Atlantis versions through 0.47.1 are affected where the GitHub App setup endpoint is reachable. The issue concerns the /github-app/setup endpoint used during GitHub App setup.

Q: What must an attacker do to exploit this?

No authentication is required to call the affected endpoint. The attacker must be able to observe or intercept the GitHub redirect during setup to obtain the returned RSA private key and webhook secret.

Q: What could an attacker do with the exposed credentials?

An attacker who obtains the RSA private key can mint GitHub App installation tokens. The webhook secret can be used to forge GitHub webhook payloads.

Published Aug 28, 2026

Updated

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

Affected Software

1 affected component

Atlantis<=0.47.1

Event History

Aug 28, 2026

CVE Published

via MITRE·04:19 PM

Data Sourced

via MITRE·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Atlantis versions through 0.47.1 are affected where the GitHub App setup endpoint is reachable. The issue concerns the /github-app/setup endpoint used during GitHub App setup.

What must an attacker do to exploit this?

No authentication is required to call the affected endpoint. The attacker must be able to observe or intercept the GitHub redirect during setup to obtain the returned RSA private key and webhook secret.

What could an attacker do with the exposed credentials?