# Atlantis 0.49.0 fixes 12 security flaws, including a critical forged-webhook fork-protection bypass that leads to remote code execution · pwn.watch > On October 25 the Atlantis project (the Terraform pull request automation server) released v0.49.0 and published 12 GitHub security advisories fixed in it. The worst, GHSA-6mjf-4m52-m5cq (CVSS 9.8, critical), comes from Atlantis checking only the path of a pull request's clone URL and not its host, while trusting the head repository name from the webhook body: a forged webhook can point Atlantis at an attacker's git server, pass the --allow-fork-prs=false gate and --repo-allowlist, and have Atlantis fetch and plan a Terraform tree the attacker controls. Servers without a GitHub webhook secret accept that forged webhook from anyone without authentication. Other fixes cover a Gitea dismissed-approval bypass of apply_requirements (GHSA-fm5f-jg8p-x2vw, 8.8), an allowed_workflows allow-list bypass in multi-project atlantis.yaml files (GHSA-56q6-8vmp-v2qm, 8.2), a plan-hijack apply-approval bypass (GHSA-5vwh-xc92-8h64), a pull request symlink that makes Terraform run outside the checkout (GHSA-9q39-mgw7-5789), unauthenticated lock metadata on /api/locks (GHSA-xgrg-fpp6-q6fm), timing attacks on Basic Auth and API secrets plus path traversal on /api/plan and /api/apply, an arbitrary file read via --var-file, secrets leaking into PR comments when output hiding errors, and a CSRF in the GitHub App setup callback. The advisories do not mention exploitation. v0.49.0 is a breaking release: GitHub and GHES webhooks whose clone URL host differs from --gh-hostname are now rejected, and the Docker images no longer bundle Terraform or OpenTofu. Anyone upgrading from v0.47.0 or earlier also picks up the v0.47.1 fix for CVE-2026-116676, a PR-controlled workspace name that was passed unquoted into a shell command. Upgrade to 0.49.0 and set a GitHub webhook secret. Page: https://pwn.watch/i/atlantis-0-49-0-security-fixes-fork-bypass-rce-oct-2026 · generated 2026-10-28T02:45:21.103Z ## Status - Severity: critical · status: live · patch: patched - Product: Atlantis (Terraform pull request automation) - Started: 2026-10-25 - CVEs: CVE-2026-116676 - Affected: Atlantis before 0.49.0 (GHSA-9q39-mgw7-5789 affects 0.45.0 to 0.48.x); Atlantis 0.4.0 to 0.47.0 for CVE-2026-116676 - Fixed in: Atlantis 0.49.0; Atlantis 0.47.1 for CVE-2026-116676 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/atlantis-0-49-0-security-fixes-fork-bypass-rce-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/atlantis-0-49-0-security-fixes-fork-bypass-rce-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/atlantis-0-49-0-security-fixes-fork-bypass-rce-oct-2026.json - This file: https://pwn.watch/i/atlantis-0-49-0-security-fixes-fork-bypass-rce-oct-2026/llms.txt ## Updates (newest first) - 2026-10-25: Atlantis releases v0.49.0, a breaking release that fixes 12 security advisories, led by the critical forged-webhook fork-protection bypass GHSA-6mjf-4m52-m5cq. (https://github.com/runatlantis/atlantis/releases/tag/v0.49.0) - 2026-08-25: Atlantis publishes GHSA-rjh2-4xgw-p2hj, a shell command injection through a PR-controlled Terraform workspace name, fixed in 0.47.1 and now tracked as CVE-2026-116676. (https://github.com/runatlantis/atlantis/security/advisories/GHSA-rjh2-4xgw-p2hj) ## Fix brief # Security brief: Atlantis 0.49.0 fixes 12 security flaws, including a critical forged-webhook fork-protection bypass that leads to remote code execution Source: https://pwn.watch/i/atlantis-0-49-0-security-fixes-fork-bypass-rce-oct-2026 · status: live · severity: critical · updated Oct 28, 2026, 01:42 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is On October 25 the Atlantis project (the Terraform pull request automation server) released v0.49.0 and published 12 GitHub security advisories fixed in it. The worst, GHSA-6mjf-4m52-m5cq (CVSS 9.8, critical), comes from Atlantis checking only the path of a pull request's clone URL and not its host, while trusting the head repository name from the webhook body: a forged webhook can point Atlantis at an attacker's git server, pass the --allow-fork-prs=false gate and --repo-allowlist, and have Atlantis fetch and plan a Terraform tree the attacker controls. Servers without a GitHub webhook secret accept that forged webhook from anyone without authentication. Other fixes cover a Gitea dismissed-approval bypass of apply_requirements (GHSA-fm5f-jg8p-x2vw, 8.8), an allowed_workflows allow-list bypass in multi-project atlantis.yaml files (GHSA-56q6-8vmp-v2qm, 8.2), a plan-hijack apply-approval bypass (GHSA-5vwh-xc92-8h64), a pull request symlink that makes Terraform run outside the checkout (GHSA-9q39-mgw7-5789), unauthenticated lock metadata on /api/locks (GHSA-xgrg-fpp6-q6fm), timing attacks on Basic Auth and API secrets plus path traversal on /api/plan and /api/apply, an arbitrary file read via --var-file, secrets leaking into PR comments when output hiding errors, and a CSRF in the GitHub App setup callback. The advisories do not mention exploitation. v0.49.0 is a breaking release: GitHub and GHES webhooks whose clone URL host differs from --gh-hostname are now rejected, and the Docker images no longer bundle Terraform or OpenTofu. Anyone upgrading from v0.47.0 or earlier also picks up the v0.47.1 fix for CVE-2026-116676, a PR-controlled workspace name that was passed unquoted into a shell command. Upgrade to 0.49.0 and set a GitHub webhook secret. Severity detail: CVSS 9.8 for GHSA-6mjf-4m52-m5cq, exploitable without authentication when no GitHub webhook secret is set; the advisories do not mention exploitation - Product: Atlantis (Terraform pull request automation) - CVE / advisory ids: CVE-2026-116676 ## Affected versions - Atlantis before 0.49.0 (GHSA-9q39-mgw7-5789 affects 0.45.0 to 0.48.x) - Atlantis 0.4.0 to 0.47.0 for CVE-2026-116676 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Atlantis 0.49.0 - Atlantis 0.47.1 for CVE-2026-116676 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 25, 2026: Atlantis releases v0.49.0, a breaking release that fixes 12 security advisories, led by the critical forged-webhook fork-protection bypass GHSA-6mjf-4m52-m5cq. - Aug 25, 2026: Atlantis publishes GHSA-rjh2-4xgw-p2hj, a shell command injection through a PR-controlled Terraform workspace name, fixed in 0.47.1 and now tracked as CVE-2026-116676. ## Advisories - [GHSA-6mjf-4m52-m5cq: Unvalidated clone URL host enables fork-protection bypass and remote code execution](https://github.com/runatlantis/atlantis/security/advisories/GHSA-6mjf-4m52-m5cq) (Atlantis) - [Atlantis v0.49.0 release notes](https://github.com/runatlantis/atlantis/releases/tag/v0.49.0) (Atlantis) - [Atlantis security advisories](https://github.com/runatlantis/atlantis/security/advisories) (Atlantis) - [GHSA-rjh2-4xgw-p2hj: OS command injection through PR-controlled Terraform workspace enables RCE during plan](https://github.com/runatlantis/atlantis/security/advisories/GHSA-rjh2-4xgw-p2hj) (Atlantis) --- Machine-readable: https://pwn.watch/i/atlantis-0-49-0-security-fixes-fork-bypass-rce-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.