Summary
Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan
Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it.
A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account. This does not require custom workflows, allow_custom_workflows, or permission to run terraform apply.
The executed command inherits the Atlantis process environment, which commonly contains cloud-provider, Terraform, and VCS credentials.
Details
Verified against current upstream/main commit 92ce5c51d1a050357e44df3535483425e59fa984 on August 13, 2026.
The vulnerable data flow is:
The PR-controlled project workspace is validated in
server/core/config/raw/project.go.Validation rejects only
..,/, and\. Shell metacharacters such as;,#,$, redirections, and whitespace remain permitted.The workspace is passed directly as a Terraform command argument in
server/core/runtime/workspace_step_runner_delegate.go:[]string{workspaceCmd, "select", ctx.Workspace}Terraform arguments are concatenated into a single string using
strings.Join(args, " ")inserver/core/terraform/tfclient/terraform_client.go:tfCmd := fmt.Sprintf("%s %s", binPath, strings.Join(args, " "))The resulting string is executed through
sh -cinserver/core/terraform/tfclient/terraform_client.go:cmd := exec.Command("sh", "-c", tfCmd)
Consequently, a workspace such as:
poc;id;false;#
produces commands equivalent to:
terraform workspace select poc;id;false;#
terraform workspace new poc;id;false;#
raw.Project.Validate() was confirmed to return no error for this workspace value.
Atlantis documents that planning untrusted Terraform can already be dangerous because providers and external data sources execute code. The distinct issue here is that an ordinary project configuration field becomes shell source, bypassing the explicit allow_custom_workflows control and requiring no malicious provider, external data source, custom workflow, or apply operation.
The primary remediation should be to execute Terraform using an argument vector rather than constructing shell source, for example, exec.Command(binaryPath, args...). Any required environment-variable expansion should be performed without invoking a shell. Strict workspace-name validation would also provide defense in depth.
PoC
Only reproduce this against a disposable Atlantis instance and test repository.
Preconditions
- Atlantis processes
atlantis.yamlfrom the pull request branch. - The pull request is eligible to run
atlantis plan. - For a fork pull request, the server must have
--allow-fork-prsenabled. A same-repository branch does not require this flag. - No custom workflows or apply permissions are required.
Repository contents
Create main.tf:
terraform {
required_version = ">= 1.0"
}
Create atlantis.yaml:
version: 3
projects:
- name: workspace-rce-poc
dir: .
workspace: "poc;id;false;#"
autoplan:
enabled: false
Open a pull request containing these files and comment:
atlantis plan -p workspace-rce-poc
Expected result
Atlantis first runs terraform workspace select. The injected false causes that command invocation to return an error, so Atlantis retries using terraform workspace new.
On both attempts, the shell executes id as a separate command. The second failure includes the combined command output in the Atlantis error response, exposing output similar to:
uid=1000(atlantis) gid=1000(atlantis) groups=1000(atlantis)
This demonstrates arbitrary shell-command execution without creating a custom workflow or reaching the apply phase.
The payload uses only id and false and does not access credentials, make network requests, or modify the host beyond Terraform potentially creating the disposable poc workspace.
Impact
This is an OS command injection vulnerability resulting in remote code execution as the Atlantis service account.
Affected deployments are those that:
- Process pull-request-controlled
atlantis.yamlproject configuration; and - Permit the attacker-controlled pull request to trigger an Atlantis plan.
Potential consequences include:
- Reading and exfiltrating cloud-provider, Terraform, and VCS credentials inherited from the Atlantis process.
- Accessing Terraform state, plan files, repository checkouts, caches, and other data available to the Atlantis user.
- Modifying files or binaries accessible to the service account.
- Making network requests using the Atlantis server's network identity.
- Pivoting into infrastructure accessible through the server's credentials or network placement.
For public repositories, arbitrary external contributors are directly exposed when --allow-fork-prs is enabled. Without fork PR support, the vulnerable population includes users able to create eligible same-repository pull requests and attackers controlling such accounts.
Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.
CVE-2026-116676 has a CVSS score of 8.8 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.47.1); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2026-116676? CVE-2026-116676 is a high-severity OS command injection vulnerability in github.com/runatlantis/atlantis (go), affecting versions >= 0.4.0, <= 0.47.0. It is fixed in 0.47.1. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
- How severe is CVE-2026-116676? CVE-2026-116676 has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/runatlantis/atlantis are affected by CVE-2026-116676? github.com/runatlantis/atlantis (go) versions >= 0.4.0, <= 0.47.0 is affected.
- Is there a fix for CVE-2026-116676? Yes. CVE-2026-116676 is fixed in 0.47.1. Upgrade to this version or later.
- Is CVE-2026-116676 exploitable, and should I be worried? Whether CVE-2026-116676 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-116676 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-116676? Upgrade
github.com/runatlantis/atlantisto 0.47.1 or later.