Atlantis: shell metacharacters in a pull request workspace name run commands as the Atlantis service account

Impact

Atlantis joins Terraform arguments into a single string and runs them through sh -c, so the workspace value taken from a pull request's atlantis.yaml is interpreted by the shell. Any contributor whose pull request is eligible for a plan gets command execution as the Atlantis service account - no custom workflow, no apply permission, no malicious provider needed. On a fleet where Atlantis holds the credentials that build the cluster, that account is usually the most privileged thing in the control plane: cloud provider keys, Terraform state, and version-control tokens are all in its environment, which is enough to re-provision nodes, change network and IAM policy, or read state containing secrets. Fork pull requests reach it only when --allow-fork-prs is set; branches in the same repository do not need that option.

Who can reach it

Any authenticated user who can open a pull request that Atlantis will plan - typically anyone with write access to the repository, or any external contributor if --allow-fork-prs is enabled. Network access to Atlantis itself is not required; the webhook carries the payload.

What to do

Upgrade Atlantis to 0.47.1 and restart the service - a single daemon restart, no node impact, and in-flight plans can be re-run from the pull request. Until then, disable --allow-fork-prs, tighten who can push branches to repositories Atlantis watches, and treat the credentials in the Atlantis environment as exposed: rotate cloud and VCS tokens if untrusted pull requests were planned on an affected version.

References

Related entries

• Jenkins: XStream deserialization filter not applied to resolves-to classesCVE-2026-117612 · Jenkins controller (XStream deserialization filter, resolves-to attribute)High
• Jenkins: unvalidated agent name lets a read-only user load and overwrite arbitrary config.xml on the controllerCVE-2026-117616 · Jenkins controller (agent-by-name HTTP endpoint)High
• Jenkins: low-privilege user can seed Manage Old Data warnings that overwrite user accounts including passwordsCVE-2026-117620 · Jenkins controller ("Manage Old Data" migration feature)High
• Jenkins: root element check bypass allows nesting types meant to live only in top-level config filesCVE-2026-117624 · Jenkins controller (XStream root element check for top-level configuration types)High
• MinIO: unsigned x-amz-* headers accepted in SigV4, escalating a presigned PUT into a cross-bucket readCVE-2026-122267 · MinIO (S3 Signature V4 verification)High
• Grafana: symlink escape in plugin archive extraction gives remote code execution as the Grafana processCVE-2026-15815 · Grafana OSS / Enterprise (plugin archive extraction)High