Description

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.0",
  "pubDate": "2026-08-28T20:20:19.523Z",
  "pubdate": "2026-08-28T20:20:19.523Z",
  "executiveSummary": "A critical authentication bypass vulnerability exists in Atlantis through version 0.47.1, specifically affecting the /github-app/setup endpoint.\nThis vulnerability allows unauthenticated attackers to access sensitive GitHub App credentials by intercepting or observing the redirect process during the initial setup phase.\nThe primary risk involves the unauthorized acquisition of RSA private keys and webhook secrets, which are critical components for authenticating as a GitHub App.\nBy leveraging these stolen credentials, an attacker can mint legitimate installation tokens and forge webhook payloads, effectively granting them elevated administrative control over the target organization's repositories.\nThis flaw represents a severe security risk as it bypasses the standard authentication gate for GitHub integration, requiring no prior system privileges for exploitation.\nThe vulnerability is localized to the GitHub App integration flow, and organizations utilizing the GitHub App mode within the affected version range are inherently exposed to potential unauthorized system compromise.",
  "technicalDetails": "The vulnerability originates from a failure to implement proper access control mechanisms on the /github-app/setup endpoint within the Atlantis application.\nThe root cause is a lack of server-side session or token validation during the GitHub App installation callback process, allowing the endpoint to be accessed by unauthenticated entities.\nIn a standard GitHub App integration flow, the user is redirected to the GitHub setup URL, which subsequently redirects back to the /github-app/setup endpoint with specific installation parameters.\nBecause the /github-app/setup endpoint does not verify the initiator of the request, an attacker can monitor network traffic or anticipate the redirect flow to access this endpoint prematurely or by intercepting the callback.\nUpon reaching the endpoint, the attacker can extract sensitive GitHub App configuration details, including the RSA private key used for generating JSON Web Tokens (JWTs) and the webhook secret utilized for validating request authenticity.\nWith the RSA private key, the attacker can perform unauthorized authentication as the GitHub App, enabling the creation of installation access tokens (IATs). These tokens grant the attacker programmatic access to perform actions on behalf of the application with its configured repository permissions.\nFurthermore, obtaining the webhook secret enables the attacker to sign malicious webhook payloads. Because the secret is the shared component used for Hash-based Message Authentication Code (HMAC) verification, the attacker can successfully spoof events, potentially triggering arbitrary workflows or manipulating repository states without triggering security alerts.\nThis vulnerability effectively renders the GitHub App integration's security posture void, as the core secrets protecting the integration identity are exposed in plain text during the handshake process.\nThe flaw affects all Atlantis versions up to and including 0.47.1, with the vulnerability existing in the application's core GitHub integration logic.\nExploitation is possible over the network, requires no special privileges on the Atlantis instance, and leverages the inherent design of the GitHub redirect flow to bypass authentication checks."
}