CVE-2026-64679

creationtimestamp| type| source ---|---|--- 2026-08-21 22:35:19+00:00| published-proof-of-concept| https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28 2026-08-22 02:01:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtn6l3hsty2o 2026-08-22...

CVE-2026-64679

Atlantis , a self-hosted Go application that processes Terraform pull request events via webhooks, is affected by a path traversal vulnerability in its workspace handling. From version 0.19.8 through 0.44.x , user-controlled workspace values supplied via repository-level atlantis.yaml configurati...

EUVD-2026-64142

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

CVE-2026-64679 Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

GO-2025-3940 vulnerabilities

Vulnerabilities for packages: atlantis-fips, atlantis...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, goreleaser, kyverno-policy-reporter, kubernetes-event-exporter-fips, argo-rollouts-fips, argo-events, atlantis-fips, kyverno-policy-reporter-fips, argo-cd, kubewatch, bento, bento-fips, argo-events-fips, ory-kratos, atlantis, peerdb-flow, ory-kratos-fip...

GO-2025-3540 vulnerabilities

Vulnerabilities for packages: atlantis, falcosidekick, authservice, oauth2-proxy, gitea, kots, fluent-bit-plugin-loki, splunk-otel-collector...

GO-2025-3940 vulnerabilities

Vulnerabilities for packages: atlantis...

GO-2026-5410 vulnerabilities

Vulnerabilities for packages: atlantis, bento, argo-cd, argo-rollouts, goreleaser, kubewatch, kyverno-policy-reporter, argo-events, kubernetes-event-exporter...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: net-kourier, kube-logging-operator-custom-runner, k9s, kbld, cilium, vertical-pod-autoscaler, pgpool2exporter, crossplane, crossplane-provider-aws-cloudformation, kiali, percona-server-mongodb-operator, kots, goreleaser, litestream, kubernetes-csi-external-snapshotte...

GO-2024-2611 vulnerabilities

Vulnerabilities for packages: k9s, falcosidekick, memcached-exporter, rabbitmq-messaging-topology-operator, supercronic, ferretdb, pgpool2exporter, vertical-pod-autoscaler, crossplane, crossplane-provider-aws-cloudformation, kots, goreleaser, k3d, cilium-cli, prometheus-alertmanager, k8sgpt,...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: k9s, cilium, argo-cd, crossplane-provider-aws-cloudformation, telegraf, kots, chisel, cilium-cli, k8sgpt, gptscript, pulumi-language-dotnet, crossplane-provider-aws-cloudwatchlogs, crossplane-provider-aws-route53, splunk-otel-collector, fscrypt, go-discover, aactl,...

CVE-2026-56852 vulnerabilities

Vulnerabilities for packages: crossplane-aws-monolith-fips, openbao, opentelemetry-collector, crossplane-provider-aws-rds-fips, flyte, jetstream-controller-fips, crossplane-provider-aws-qldb-fips, newrelic-k8s-metrics-adapter-fips, grafana-pyroscope-fips, crossplane-provider-aws-cloudwatchevents,...

GHSA-JPJM-C3R5-Q96R vulnerabilities

Vulnerabilities for packages: crossplane-aws-monolith-fips, openbao, opentelemetry-collector, crossplane-provider-aws-rds-fips, flyte, jetstream-controller-fips, crossplane-provider-aws-qldb-fips, newrelic-k8s-metrics-adapter-fips, grafana-pyroscope-fips, crossplane-provider-aws-cloudwatchevents,...

GHSA-JPJM-C3R5-Q96R vulnerabilities

Vulnerabilities for packages: terraform-provider-time, k9s, falcosidekick, cilium, sftpgo-plugin-eventsearch, tfsec, ferretdb, argo-cd, crossplane, blob-csi, crossplane-provider-aws-cloudformation, kiali, kots, goreleaser, percona-server-mongodb-operator, kubernetes-csi-external-snapshotter,...

CVE-2026-56852 vulnerabilities

Vulnerabilities for packages: terraform-provider-time, k9s, falcosidekick, cilium, sftpgo-plugin-eventsearch, tfsec, ferretdb, argo-cd, crossplane, blob-csi, crossplane-provider-aws-cloudformation, kiali, kots, goreleaser, percona-server-mongodb-operator, kubernetes-csi-external-snapshotter,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: k9s, cilium, argo-cd, telegraf, kots, chisel, cilium-cli, k8sgpt, gptscript, pulumi-language-dotnet, splunk-otel-collector, fscrypt, go-discover, aactl, eksctl, cosign, ko, wolfictl, steampipe, step-issuer, gatus, terragrunt, prometheus, istio, buildkitd, tkn,...

CLEANSTART-2026-TY63648 CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs

Multiple security vulnerabilities affect the atlantis-fips package. The CombinedMult function in the CIRCL ecc/p384 package secp384r1 curve produces an incorrect value for specific inputs. See references for individual vulnerability details...

CLEANSTART-2026-WH33500 CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs

Multiple security vulnerabilities affect the atlantis-fips package. The CombinedMult function in the CIRCL ecc/p384 package secp384r1 curve produces an incorrect value for specific inputs. See references for individual vulnerability details...

CLEANSTART-2026-WG17155 CombinedMult function in the CIRCL ecc/p384 package (secp384r1 curve) produces an incorrect value for specific inputs

Multiple security vulnerabilities affect the atlantis package. The CombinedMult function in the CIRCL ecc/p384 package secp384r1 curve produces an incorrect value for specific inputs. See references for individual vulnerability details...