#Terraform

Atlantis 0.49.0 fixes 12 security flaws, including a critical forged-webhook fork-protection bypass that leads to remote code execution

On October 25 the Atlantis project (the Terraform pull request automation server) released v0.49.0 and published 12 GitHub security advisories fixed in it. The worst, GHSA-6mjf-4m52-m5cq (CVSS 9.8, critical), comes from Atlantis checking only the path of a pull request's clone URL and not its host, while trusting the head repository name from the webhook body: a forged webhook can point Atlantis at an attacker's git server, pass the --allow-fork-prs=false gate and --repo-allowlist, and have Atlantis fetch and plan a Terraform tree the attacker controls. Servers without a GitHub webhook secret accept that forged webhook from anyone without authentication. Other fixes cover a Gitea dismissed-approval bypass of apply_requirements (GHSA-fm5f-jg8p-x2vw, 8.8), an allowed_workflows allow-list bypass in multi-project atlantis.yaml files (GHSA-56q6-8vmp-v2qm, 8.2), a plan-hijack apply-approval bypass (GHSA-5vwh-xc92-8h64), a pull request symlink that makes Terraform run outside the checkout (GHSA-9q39-mgw7-5789), unauthenticated lock metadata on /api/locks (GHSA-xgrg-fpp6-q6fm), timing attacks on Basic Auth and API secrets plus path traversal on /api/plan and /api/apply, an arbitrary file read via --var-file, secrets leaking into PR comments when output hiding errors, and a CSRF in the GitHub App setup callback. The advisories do not mention exploitation. v0.49.0 is a breaking release: GitHub and GHES webhooks whose clone URL host differs from --gh-hostname are now rejected, and the Docker images no longer bundle Terraform or OpenTofu. Anyone upgrading from v0.47.0 or earlier also picks up the v0.47.1 fix for CVE-2026-116676, a PR-controlled workspace name that was passed unquoted into a shell command. Upgrade to 0.49.0 and set a GitHub webhook secret.

Atlantis (Terraform pull request automation)·Since Oct 25, 2026·updated Oct 27, 2026, 17:46 UTC