GHSA-XH7V-965R-23F7 Atlantis Exposes Service Version Publicly on /status API Endpoint

Summary Atlantis publicly exposes detailed version information on its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. Details The /statu...

PT-2025-36399

Name of the Vulnerable Software and Affected Versions Atlantis affected versions not specified Description Atlantis, a self-hosted golang application that listens for Terraform pull request events via webhooks, exposes detailed version information through the /status endpoint. This information...

CVE-2025-58058 vulnerabilities

Vulnerabilities for packages: k9s-fips, nuclei, regclient-fips, drone, trufflehog, drone-fips, mattermost-fips, atlantis-fips, cloudbeat, grafana-alloy, terraform, gitness, prometheus-podman-exporter, rancher-fleet, tflint, undock, syft-fips, vcluster, cg, grype-db, vcluster-fips, cloudbeat-fips,...

GHSA-2X5J-VHC8-9CWM vulnerabilities

Vulnerabilities for packages: actions-runner-controller, nuclei, atlantis, hydra, crossplane-provider-aws-cloudformation, terraform-provider-pagerduty, grafana, tfsec, gitsign, kyverno-notation-aws, crossplane-provider-aws-s3, vault, cluster-api, sops, q, caddy-fips, openbao-fips, snyk-cli,...

CVE-2024-52009

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2018-3983

An exploitable uninitialized pointer vulnerability exists in the Word document parser of the the Atlantis Word Processor. A specially crafted document can cause an array fetch to return an uninitialized pointer and then performs some arithmetic before writing a value to the result. Usage of this...

Hackers Using E-Crime Tool Atlantis AIO for Credential Stuffing on 140+ Platforms

Threat actors are leveraging an e-crime tool called Atlantis AIO Multi-Checker to automate credential stuffing attacks, according to findings from Abnormal Security. Atlantis AIO "has emerged as a powerful weapon in the cybercriminal arsenal, enabling attackers to test millions of stolen...

Malicious code in atlantis-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 094067edee2b5602a50659db017bc266d4d2a8b841374fec88825e3e0dc47816 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11942 Malicious code in atlantis-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 094067edee2b5602a50659db017bc266d4d2a8b841374fec88825e3e0dc47816 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45337 vulnerabilities

Vulnerabilities for packages: frp, pulumi-language-yaml, neuvector, dynamic-localpv-provisioner, eks-distro, flux-image-automation-controller-fips, azure-aad-pod-identity-mic, buf, certificate-transparency-fips, undock, beats-fips, flux-helm-controller-fips, velero-plugin-for-microsoft-azure-fips...

SUSE CVE-2024-52009

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

GO-2024-3265 Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis

Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis...

CVE-2024-52009

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2024-52009 Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2024-52009

Atlantis (a self-hosted Golang app that handles Terraform PR webhooks) exposes GitHub credentials in its logs when rotated. The root cause is that credentials (tokens like gh s_…) were written to logs, enabling someone with log access to impersonate Atlantis and perform GitHub actions, potentiall...

CVE-2024-52009 Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

CVE-2024-52009 Git credentials are exposed in atlantis logs

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on...

Git credentials are exposed in Atlantis logs

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. Thi...

GHSA-GPPM-HQ3P-H4RP Git credentials are exposed in Atlantis logs

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. Atlantis logs contains GitHub credentials tokens ghs... when they are rotated. Thi...

Atlantis 日志信息泄露漏洞

Atlantis is a self-hosted golang application from the Atlantis open source. It listens to Terraform pull request events via webhook. Atlantis has a log information disclosure vulnerability that stems from Atlantis logs containing GitHub credentials during rotation. An attacker who could read thes...