Is CVE-2026-116676 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116676 being exploited in the wild.

How severe is CVE-2026-116676?

High severity, with a CVSS score of 8.8, published 27 October 2026.

Which products and versions are affected?

github.com/runatlantis/atlantis (Go) >= 0.4.0, <= 0.47.0, SEMVER:introduced=0.4.0,fixed=0.47.1; RunAtlantis Atlantis 0.4.0 through 0.47.0.

How is CVE-2026-116676 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116676?

Check whether you run github.com/runatlantis/atlantis (Go) or RunAtlantis Atlantis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116676: Atlantis shell command injection in workspace argument parsing

Q: Is there a fix for CVE-2026-116676?

Yes. github.com/runatlantis/atlantis (Go): upgrade to 0.47.1 or later. Until then: Restrict pull request webhook access to trusted contributors only, or disable the `-w` workspace override flag and the `--allow-fork-prs` option until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116676 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116676?

Check whether you run github.com/runatlantis/atlantis (Go) or RunAtlantis Atlantis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116676 · Severity: high · CVSS 8.8 · Published 2026-10-27

Atlantis is a self-hosted tool that orchestrates Terraform deployments through pull request webhooks. Versions 0.4.0 through 0.47.0 allow authenticated contributors to inject arbitrary shell commands via workspace names in pull request comments or configuration files, leading to remote code execution with the privileges of the Atlantis service account and access to cloud credentials and state files.

Technologies: github.com/runatlantis/atlantis (Go). Vendors: Go.

Quick answers

Is CVE-2026-116676 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116676 being exploited in the wild.
How severe is CVE-2026-116676?: High severity, with a CVSS score of 8.8, published 27 October 2026.
Which products and versions are affected?: github.com/runatlantis/atlantis (Go) >= 0.4.0, <= 0.47.0, SEMVER:introduced=0.4.0,fixed=0.47.1; RunAtlantis Atlantis 0.4.0 through 0.47.0.
Is there a fix for CVE-2026-116676?: Yes. github.com/runatlantis/atlantis (Go): upgrade to 0.47.1 or later. Until then: Restrict pull request webhook access to trusted contributors only, or disable the `-w` workspace override flag and the `--allow-fork-prs` option until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116676 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116676?: Check whether you run github.com/runatlantis/atlantis (Go) or RunAtlantis Atlantis at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/runatlantis/atlantis (Go): upgrade to 0.47.1 or later
```
go get github.com/runatlantis/atlantis@v0.47.1
```

Restrict pull request webhook access to trusted contributors only, or disable the `-w` workspace override flag and the `--allow-fork-prs` option until upgrading.

Technical details

The vulnerability is a shell command injection (CWE-78) where Atlantis constructs Terraform command lines by joining arguments with spaces and executing them via `sh -c`. Workspace names from pull request-controlled inputs (atlantis.yaml, -w comment flag, Terraform Cloud configuration, and API requests) are not properly validated for shell metacharacters before being passed to the shell. An authenticated attacker can include shell metacharacters in the workspace name to execute arbitrary commands as the Atlantis service account, with access to the process environment including cloud provider credentials.

Affected products

RunAtlantis Atlantis 0.4.0 through 0.47.0

Identifiers

CVE-2026-116676
GHSA-rjh2-4xgw-p2hj
GO-2026-6871

Timeline

2026-08-20: patched: Security fix committed to main branch
2026-10-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.