CVE-2024-52009 Git credentials are exposed in atlantis logs

What is CVE-2024-52009?

CVE-2024-52009 is a high-severity vulnerability in runatlantis atlantis, published on 8 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-532

Which versions are affected by CVE-2024-52009?

3 open source packages ship an affected version, including github.com/runatlantis/atlantis. It affects 1 product.

Products include Runatlantis Atlantis.

How do I fix CVE-2024-52009?

Upgrade github.com/runatlantis/atlantis to 0.30.0 or later.

Is CVE-2024-52009 being exploited?

There is no known exploitation of CVE-2024-52009 in the wild and no public exploit code.

Other vulnerabilities in runatlantis atlantis

• CVE-2022-24912 Timing Attack High 7.5
• CVE-2025-58445 Atlantis Exposes Service Version Publicly on /status API Endpoint Medium 6.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gppm-hq3p-h4rp, GO-2024-3265.