Most recent entries from all

EUVD-2026-200833

2026-10-05T13:25:34.532112+00:00

EUVD-2026-200833

fkie_cve-2024-52009

2026-10-05T13:25:34.532166+00:00

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

GHSA-gppm-hq3p-h4rp — Git credentials are exposed in Atlantis logs

2026-10-05T13:25:34.532228+00:00

Affected: Go: github.com/runatlantis/atlantis

### Summary _Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._

Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub.

When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization.

This was reported in https://github.com/runatlantis/atlantis/issues/4060 and fixed in https://github.com/runatlantis/atlantis/pull/4667 . The fix was included in [Atlantis v0.30.0](https://github.com/runatlantis/atlantis/releases/tag/v0.30.0).

### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._

While auditing the Kubernetes/Argo CD/Atlantis deployment of some company, the following set-up was encountered:

- Most employees have read-only access to Argo CD, enabling them to see the health of deployed applications. - Atlantis was deployed as an Argo CD application. - Atlantis was used to manage the configuration of a GitHub organization (such as team members), using [Terraform's GitHub integration](https://registry.terraform.io/providers/integrations/github/latest).

Atlantis logs on Argo CD contained lines such as:

```json {"level":"debug","ts":"2024-11…

openSUSE-SU-2024:14515-1 — govulncheck-vulndb-0.0.20241120T172248-1.1 on GA media

2026-10-05T13:25:34.532337+00:00

govulncheck-vulndb-0.0.20241120T172248-1.1 on GA media