CVE-2026-116676 in Atlantis
Summary
by MITRE • 10/27/2026
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
Atlantis is a self-hosted application written in Go designed to automate infrastructure management by listening for Terraform pull request events via webhooks. A critical security vulnerability exists within versions ranging from 0.4.0 up to and including 0.47.1, where the application fails to properly sanitize user-supplied input before executing system commands. Specifically, when processing a pull request that triggers an Atlantis plan, the software retrieves the workspace name defined in the atlantis.yaml configuration file associated with that pull request. This workspace value is then passed directly into Terraform command arguments using strings.Join(args, " ") and subsequently executed through a shell invocation via sh -c. This architectural decision creates a classic command injection vector because the input data is treated as executable code rather than static string parameters.
The technical flaw stems from the improper handling of special characters within the workspace name field. An authenticated contributor whose pull request is eligible for an Atlantis plan can inject shell metacharacters into this value. Because the resulting command line is interpreted by a standard POSIX-compliant shell, these injected characters allow the attacker to break out of the intended Terraform execution context and append arbitrary commands. This exploitation does not require custom workflows, apply permissions, or the presence of a malicious Terraform provider, significantly lowering the barrier for attack initiation compared to other potential infrastructure compromise vectors.
The operational impact of this vulnerability is severe, resulting in remote code execution as the Atlantis service account. The executed commands inherit the full environment and privileges of the Atlantis process. Consequently, an attacker can access sensitive cloud-provider credentials, Terraform state files containing secrets, version-control tokens, and any other network or file system resources available to that specific service account. This level of access allows for comprehensive data exfiltration, lateral movement within the infrastructure, and potential modification of critical deployment configurations. The vulnerability is accessible via fork pull requests only when the --allow-fork-prs configuration option is enabled, whereas eligible branches from the same repository do not require this flag to be active, meaning a broader set of contributors may potentially exploit the flaw depending on the specific Atlantis instance configuration.
This issue aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command and represents a significant risk under MITRE ATT&CK technique T1059 Command and Scripting Interpreter. To mitigate this vulnerability, organizations running affected versions must immediately upgrade to version 0.47.1 or later where the input sanitization logic has been corrected. Until upgrading is possible, administrators should disable the --allow-fork-prs flag if fork-based contributions are not strictly required for their workflow, thereby restricting potential attack surfaces to internal contributors only. Additionally, implementing strict allowlists for workspace names and ensuring that Atlantis runs with minimal necessary privileges can further reduce the blast radius of any successful exploitation attempt.