CVE-2025-58445 Atlantis Exposes Service Version Publicly on /status API Endpoint

Medium 6.9 Published 6 Sep 2025 Updated 8 Sep 2025

Atlantis publicly exposes detailed version information via its /status endpoint, allowing attackers to identify specific versions and target known vulnerabilities.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2025-58445?

CVE-2025-58445 is a medium-severity vulnerability in runatlantis atlantis, published on 6 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.

Weakness: CWE-200

Which versions are affected by CVE-2025-58445?

3 open source packages ship an affected version, including github.com/runatlantis/atlantis. It affects 1 product.

Package	Affected	Fixed in
`github.com/runatlantis/atlantis` Go	All versions	None
`github.com/runatlantis/atlantis` Go	All versions to `0.35.1`	None
`github.com/runatlantis/atlantis` Go	All versions to `0.35.1`	None

Products include Runatlantis Atlantis.

How do I fix CVE-2025-58445?

No fix published yet.

Is CVE-2025-58445 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-58445 exists.

Sources

Also known as GHSA-xh7v-965r-23f7, GO-2025-3940, MINI-4fpr-3f2x-mv4w, MINI-7f54-f2cr-7r45.