CVE-2026-64679

creationtimestamp| type| source ---|---|--- 2026-08-21 22:35:19+00:00| published-proof-of-concept| https://github.com/runatlantis/atlantis/security/advisories/GHSA-26w5-6g95-gj28 2026-08-22 02:01:39+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mtn6l3hsty2o 2026-08-22...

GO-2024-3265 Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis

Git credentials are exposed in Atlantis logs in github.com/runatlantis/atlantis...

CVE-2022-24912

The vulnerability is in github.com/runatlantis/atlantis/server/controllers/events (pre-0.19.7) where webhook secret validation uses a non-constant-time comparison, enabling timing attacks to recover the secret and forge webhook events. This aligns with CVE-2022-24912 and related advisories. Impac...

CVE-2022-24912 Timing Attack

The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an...