Description
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.
Published: 2026-10-27
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Atlantis, a self-hosted Terraform automation tool, allows an authenticated contributor to supply a pull‑request‑controlled workspace name that is concatenated into a command string and executed via the shell. The workspace value is not sanitized, enabling the injection of shell metacharacters. An attacker can execute arbitrary commands as the Atlantis service account, gaining full access to any credentials or resources exposed to that account, including cloud provider tokens and Terraform state files.

Affected Systems

All installations of runatlantis Atlantis from version 0.4.0 through 0.47.1 are vulnerable. The problem arises when the application forwards the workspace field from atlantis.yaml into the Terraform command without any validation during plan operations.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity with full impact on confidentiality, integrity, and availability of the affected infrastructure. The flaw can be exploited by anyone who can create or modify a pull request in a repository that Atlantis monitors, without needing custom workflows or an attacker‑controlled provider. The vulnerability is not currently listed in CISA KEV and no EPSS score is available, but the attack vector is straightforward: a malicious workspace name in a pull request triggers the injection. Prompt patching is advised to eliminate this remote code execution channel.

Generated by OpenCVE AI on October 27, 2026 at 18:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Atlantis to version 0.47.1 or later, which removes the unsanitized workspace handling
  • If upgrading is not immediately possible, disable the --allow-fork-prs flag and restrict workspace names in atlantis.yaml to exclude shell metacharacters
  • Configure Atlantis to run Terraform commands with a restricted shell or use a non‑privileged execution agent to limit the impact of any accidental command injection

Generated by OpenCVE AI on October 27, 2026 at 18:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-rjh2-4xgw-p2hj Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
History

Tue, 27 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Runatlantis
Runatlantis atlantis
Vendors & Products Runatlantis
Runatlantis atlantis

Tue, 27 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Description Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.
Title Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Runatlantis Atlantis
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-27T17:11:12.744Z

Reserved: 2026-10-26T20:00:59.829Z

Link: CVE-2026-116676

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T18:17:35.220

Modified: 2026-10-27T18:17:35.220

Link: CVE-2026-116676

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T20:00:11Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')