Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2026-64679 high CVSS 8.1

Path Traversal in github.com/runatlantis/atlantis (CVE-2026-64679)

Summary

Path traversal in github.com/runatlantis/atlantis (CVE-2026-64679). Data can be tampered with by attackers. Exploitable via workspace. Mitigation: upgrade to 0.45.0 or later.

Original description

The description as published by the source.

Summary

Atlantis versions >= 0.19.8 and < 0.45.0 did not consistently validate user-controlled workspace values before using them to construct local workspace paths.

A crafted workspace value containing path traversal segments could cause Atlantis to resolve workspace paths outside the intended per-pull workspace directory. In vulnerable versions or code paths, Atlantis could create, use, or remove/recreate out-of-bounds directories with the privileges of the Atlantis process user, before Terraform rejected the invalid workspace name.

The issue is fixed in Atlantis 0.45.0.

Details

The issue is a path traversal vulnerability in Atlantis workspace handling. workspace values can be supplied through repository-level atlantis.yaml configuration accepted by the server or through authenticated API input. A value such as ../../../../../../../../tmp/f1-canary could escape the intended Atlantis workspace root.

In affected code paths, Atlantis used the resolved workspace path for local working-directory operations. For example, workspace values were joined into repo pull paths, and clone preparation paths could call directory removal/recreation operations such as os.RemoveAll and os.MkdirAll on the resolved directory.

PoC

In a local PoC using repo-level atlantis.yaml, the following workspace value caused Atlantis to resolve and use /tmp/f1-canary outside ~/.atlantis/repos/...:

version: 3
projects:
  - dir: .
    workspace: ../../../../..…

Source: GitHub Security Advisories (Global) NVD GitHub Advisory

Auto-generated summary

Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.

A vulnerability tracked as CVE-2026-64679 has been found in github.com/runatlantis/atlantis.
Attackers can target a specific entry point like workspace over the network to misuse the product.
Data can be tampered with by attackers. CVSS score: 8.1/10.
What to do: upgrade github.com/runatlantis/atlantis to 0.45.0 or later.
If unsure, ask your IT team or search "github.com/runatlantis/atlantis CVE-2026-64679" on the vendor's site.

CVE-2026-64679 (github.com/runatlantis/atlantis) — CWE-22 / CVSS v3 8.1
Attack vector: remote (network-reachable) / no user interaction
Attack surface: workspace / atlantis.yaml / os.RemoveAll / os.MkdirAll
Patched: 0.45.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.

❓ What is the problem

Path traversal (CWE-22) exists in github.com/runatlantis/atlantis. Attackers reach the vulnerable code path via workspace.

📍 Affected scope

Check the vendor advisory for the affected versions of github.com/runatlantis/atlantis. Attack surface: workspace / atlantis.yaml / os.RemoveAll / os.MkdirAll.

🔥 Severity

Severity: High (CVSS 8.1/10). Data can be tampered with by attackers.

🔧 How to fix

Update to 0.45.0.

🛡️ Workaround

Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.

🔍 Detection

Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/runatlantis/atlantis' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

  1. 1
    Identify exposure identify 
    grep -r 'github.com/runatlantis/atlantis' . | grep -v node_modules

    リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で github.com/runatlantis/atlantis を grep し、稼働しているサービス・バージョンを把握する。

  2. 2
    Apply patch patch 
    Upgrade github.com/runatlantis/atlantis to 0.45.0

    ステージング環境で 0.45.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。

  3. 3
    Post-deployment verification verify 
    Confirm patched version is live in production

    パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。

Affected packages

go github.com/runatlantis/atlantis
[{"type":"SEMVER","events":[{"introduced":"0.19.8"},{"fixed":"0.45.0"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details