CVE-2026-82282

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-82282", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-28T11:12:51.276Z", "datePublished": "2026-08-28T16:19:01.750Z", "dateUpdated": "2026-09-24T14:20:12.233Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:20:12.233Z"}, "datePublic": "2026-07-02T00:00:00.000Z", "title": "Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers", "descriptions": [{"lang": "en", "value": "Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "affected": [{"vendor": "runatlantis", "product": "atlantis", "versions": [{"version": "0", "lessThanOrEqual": "0.47.1", "status": "affected", "versionType": "semver"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:runatlantis:atlantis:*:*:*:*:*:*:*:*", "versionEndIncluding": "0.47.1"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 8.8, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/runatlantis/atlantis/issues/6622", "tags": ["issue-tracking"], "name": "GitHub Issue #6622"}, {"url": "https://github.com/runatlantis/atlantis", "tags": ["product"]}, {"url": "https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go", "tags": ["technical-description"], "name": "Vulnerable code: github_app_controller.go"}, {"url": "https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go", "tags": ["technical-description"], "name": "Vulnerable code: middleware.go"}, {"name": "VulnCheck Advisory: Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T16:23:29.082800Z", "id": "CVE-2026-82282", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T18:54:51.164Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-82282", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-31T16:23:29.082800Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T16:23:30.266Z"}}], "cna": {"title": "Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "runatlantis", "product": "atlantis", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.47.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-02T00:00:00.000Z", "references": [{"url": "https://github.com/runatlantis/atlantis/issues/6622", "name": "GitHub Issue #6622", "tags": ["issue-tracking"]}, {"url": "https://github.com/runatlantis/atlantis", "tags": ["product"]}, {"url": "https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go", "name": "Vulnerable code: github_app_controller.go", "tags": ["technical-description"]}, {"url": "https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go", "name": "Vulnerable code: middleware.go", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers", "name": "VulnCheck Advisory: Atlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated Callers", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "Missing Authentication for Critical Function"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:runatlantis:atlantis:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "0.47.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:20:12.233Z"}}}, "cveMetadata": {"cveId": "CVE-2026-82282", "state": "PUBLISHED", "dateUpdated": "2026-09-24T14:20:12.233Z", "dateReserved": "2026-08-28T11:12:51.276Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-28T16:19:01.750Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "atlantis", "vendor": "runatlantis", "versions": [{"lessThanOrEqual": "0.47.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery."}], "id": "CVE-2026-82282", "lastModified": "2026-09-24T20:43:32.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.8, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-82282", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-31T16:23:29.082800Z", "version": "2.0.3"}}]}, "published": "2026-08-28T20:20:19.523", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/runatlantis/atlantis"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/runatlantis/atlantis/issues/6622"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.47.1]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "atlantis", "source": "cna", "vendor": "runatlantis"}, "product": "atlantis", "vendor": "runatlantis"}], "created": "2026-08-28T22:15:04.150011+00:00", "updated": "2026-08-28T22:30:17.716109+00:00", "vendors": ["runatlantis", "runatlantis$PRODUCT$atlantis"]}