CVE-2026-64679 Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/Creation
Attackers can exploit path traversal in Atlantis workspace handling to delete or create files outside intended directories, causing data loss or service disruption.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64679?
CVE-2026-64679 is a high-severity path traversal vulnerability in runatlantis atlantis, published on 21 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated /api/plan input before joining them into local workspace paths. Traversal segments can escape the intended per-pull workspace directory and cause clone preparation or other working-directory code paths to call os.RemoveAll, os.MkdirAll, or related filesystem operations on out-of-bounds directories before Terraform rejects the invalid workspace name. This can create, delete, or reuse writable paths with the privileges of the Atlantis process, causing integrity loss or denial of service. This issue is fixed in version 0.45.0.
Which versions are affected by CVE-2026-64679?
3 open source packages ship an affected version, including github.com/runatlantis/atlantis.
| Package | Affected | Fixed in |
|---|---|---|
github.com/runatlantis/atlantis Go | From 0.19.8 | 0.45.0 |
github.com/runatlantis/atlantis Go | From 0.19.8 | 0.45.0 |
github.com/runatlantis/atlantis Go | From 0.19.8 | 0.45.0 |
How do I fix CVE-2026-64679?
Upgrade github.com/runatlantis/atlantis to 0.45.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-64679 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-64679 exists.
Sources
Also known as GHSA-26w5-6g95-gj28, GO-2026-6273, MINI-wp3h-677h-pcqr, MINI-xwcj-wg72-g25v.