https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 13:25:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-200833 EUVD-2026-200833 https://cve.radiocsirt.org/vuln/euvd-2026-200833 https://cve.radiocsirt.org/vuln/fkie_cve-2024-52009 <p>Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.</p> <p>Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-52009 https://cve.radiocsirt.org/vuln/ghsa-gppm-hq3p-h4rp <p><strong>Affected:</strong> Go: github.com/runatlantis/atlantis</p> <p>### Summary _Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._</p> <p>Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub.</p> <p>When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization.</p> <p>This was reported in https://github.com/runatlantis/atlantis/issues/4060 and fixed in https://github.com/runatlantis/atlantis/pull/4667 . The fix was included in [Atlantis v0.30.0](https://github.com/runatlantis/atlantis/releases/tag/v0.30.0).</p> <p>### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._</p> <p>While auditing the Kubernetes/Argo CD/Atlantis deployment of some company, the following set-up was encountered:</p> <p>- Most employees have read-only access to Argo CD, enabling them to see the health of deployed applications. - Atlantis was deployed as an Argo CD application. - Atlantis was used to manage the configuration of a GitHub organization (such as team members), using [Terraform&#39;s GitHub integration](https://registry.terraform.io/providers/integrations/github/latest).</p> <p>Atlantis logs on Argo CD contained lines such as:</p> <p>```json {&#34;level&#34;:&#34;debug&#34;,&#34;ts&#34;:&#34;2024-11…</p> <p><strong>Affected:</strong> Go: github.com/runatlantis/atlantis</p> <p>### Summary _Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._</p> <p>Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub.</p> <p>When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization.</p> <p>This was reported in https://github.com/runatlantis/atlantis/issues/4060 and fixed in https://github.com/runatlantis/atlantis/pull/4667 . The fix was included in [Atlantis v0.30.0](https://github.com/runatlantis/atlantis/releases/tag/v0.30.0).</p> <p>### Details _Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._</p> <p>While auditing the Kubernetes/Argo CD/Atlantis deployment of some company, the following set-up was encountered:</p> <p>- Most employees have read-only access to Argo CD, enabling them to see the health of deployed applications. - Atlantis was deployed as an Argo CD application. - Atlantis was used to manage the configuration of a GitHub organization (such as team members), using [Terraform&#39;s GitHub integration](https://registry.terraform.io/providers/integrations/github/latest).</p> <p>Atlantis logs on Argo CD contained lines such as:</p> <p>```json {&#34;level&#34;:&#34;debug&#34;,&#34;ts&#34;:&#34;2024-11…</p> https://cve.radiocsirt.org/vuln/ghsa-gppm-hq3p-h4rp https://cve.radiocsirt.org/vuln/opensuse-su-2024:14515-1 <p>govulncheck-vulndb-0.0.20241120T172248-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20241120T172248-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14515-1