High priorityDisclosed

Advisory · CVE-2026-116676

Atlantis workspace name injection executes commands as the Terraform service account

Atlantis 0.4.0 through before 0.47.1 passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined into a shell command, so an authenticated contributor whose pull request is eligible for a plan can execute arbitrary commands as the Atlantis service account, with its cloud and version-control credentials. CVSS 3.1 8.8.

Advisory published October 27, 2026Independent summary
Vendor
Runatlantis
Product
Atlantis
Identifier / CWE
CVE-2026-116676
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

Atlantis runs Terraform for pull requests, and it pastes the workspace name from the request straight into a shell command. Naming a workspace with shell punctuation turns a routine plan into the attacker's commands, run with the keys to the cloud estate.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted pull request opened

    An authenticated contributor opens a pull request eligible for an Atlantis plan, with shell metacharacters in the workspace name in atlantis.yaml.

  2. 02Plan triggered

    Atlantis builds Terraform command arguments including the workspace value.

  3. 03Shell command assembled

    The arguments are joined into a single string and executed through sh -c.

  4. 04Service account commands run

    The injected commands execute as the Atlantis service account, with access to its cloud, Terraform, and version-control credentials, state, files, and network.

What happened

The Atlantis project published CVE-2026-116676 on October 27, 2026, rated high at CVSS 3.1 8.8 in its GitHub advisory: from version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join and executed through sh -c (CWE-78). An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account, without custom workflows, apply permission, or a malicious Terraform provider.

Per the advisory, external contributors can reach the flaw through fork pull requests only when –allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. The issue is fixed in Atlantis 0.47.1.

What to do

  1. Inventory Atlantis servers and note versions; flag any server running with –allow-fork-prs enabled.
  2. Upgrade Atlantis to 0.47.1 or later.
  3. Until upgraded, disable fork pull request support if it is enabled, and restrict plan eligibility to trusted repositories and branches.
  4. Review Atlantis logs and shell history for plans with metacharacters in workspace names and for commands a plan should never have run.
  5. Rotate the cloud-provider, Terraform backend, and version-control credentials in the Atlantis environment if a suspicious plan ran, because those secrets were in the process environment.
  6. Verify the deployed version after updating.

Management note

Atlantis concentrates exactly the credentials an attacker wants, and this flaw is reachable from the contribution workflow it exists to serve. Patch it, and afterward reconsider how much privilege the service account needs: plan-time identity should not automatically be apply-time identity.