Atlantis versions through 0.47.1 contain a critical authentication bypass vulnerability in the /github-app/setup endpoint. The endpoint fails to enforce authentication, allowing unauthenticated attackers to access GitHub App credentials. By observing or intercepting the GitHub redirect during the setup flow, attackers can obtain the RSA private key and webhook secret associated with the GitHub App. With these credentials, attackers can mint installation tokens and forge webhook payloads, potentially gaining broad access to repositories and CI/CD pipeline operations. The vulnerability is tracked as CVE-2026-82282 and affects the open-source Terraform pull request automation tool Atlantis. References to the affected code exist in the GitHub App controller and middleware files. Users are advised to review their Atlantis deployments and apply patches or mitigations as available.
