« Back to list

CVE-2026-64679

Status: DeferredHigh (8.1)—

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths.

Read full descriptionShow less

Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Vector N/AC:L/PR:L permite explotación de servicios remotos sin privilegios elevados; path traversal (CWE-22) + RemoveAll/MkdirAll en directorios fuera de límites causan manipulación/eliminación de datos (T1565) e indisponibilidad (DoS).

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Network SegmentationVulnerability ScanningThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data Storage

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Runatlantis — AtlantisAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-64679",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-64679",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-25T17:04:45.481426Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "runatlantis",
          "product": "atlantis",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.19.8, < 0.45.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-21T21:17:01.920",
  "references": [
    {
      "url": "https://github.com/runatlantis/atlantis/commit/ea4e4ceebf8b387d015fff7ed8a7fcca33279afe",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/runatlantis/atlantis/pull/6254",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/runatlantis/atlantis/releases/tag/v0.45.0",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0."
    }
  ],
  "lastModified": "2026-09-09T21:06:39.057",
  "sourceIdentifier": "security-advisories@github.com"
}