---
id: CVE-2026-82282
title: >-
  Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint,
  allowing unauthenticated attackers to access GitHub App credentials
summary: >-
  Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint,
  allowing unauthenticated attackers to access GitHub App credentials. Attackers
  can observe or intercept the GitHub redirect during setup to obtain the RSA
  priv…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-306
vendor: runatlantis
product: atlantis
affected:
  - atlantis <= 0.47.1
published: '2026-08-28'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82282'
references:
  - url: 'https://github.com/runatlantis/atlantis'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/controllers/github_app_controller.go
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/runatlantis/atlantis/blob/12bfa59f44d8f65bfdda132bff61d8f8f29af1d6/server/middleware.go
    label: disclosure@vulncheck.com
  - url: 'https://github.com/runatlantis/atlantis/issues/6622'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/atlantis-github-app-setup-endpoint-returns-app-credentials-to-unauthenticated-callers
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00439
epssPercentile: 0.35448
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-31T16:23:29.082800Z'
ingestedAt: '2026-09-24T15:45:56.692Z'
---

## Overview

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.