CVE-2026-82282 - Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery. - 漏洞详情

漏洞编号：CVE-2026-82282

风险等级：高危

漏洞来源：CVE

CVE 编号：CVE-2026-82282

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-306

发布/更新时间：2026-08-28 / 2026-08-28

漏洞描述

Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery.

漏洞描述

相关链接

相关漏洞