Promote Sign in Sign up

中文 English Français Русский Español العربية

Show HN: RCE in Atlantis

Hacker News New2026-10-26 23:370 views

Show HN: RCE in Atlantis

Back in August we found this cool bypass of developer restrictions in Atlantis, leading to an unreviewed terraform apply & RCE! The vulnerable Gitea approval path dates back to the integration's introduction in v0.28.0 (May 2024), so the bypass was most likely present for roughly two and a half years before the patch shipped in October 2026. Enjoy!

Comments URL: https://news.ycombinator.com/item?id=50245574

Points: 2

# Comments: 0

Source：https://medium.com/@Vulnetic-CEO/dismissed-approval-to-rce-unreviewed-terraform-apply-in-atlantis-e2a991694a41

PreviousShow HN: Give one context across all your agents via MCP NextShow HN: Cfnrain, a community fork of AWS's archived CloudFormation CLI rain

Related posts

FiveM Script Database Migrations: What to Check Before You Install

FiveM Script Database Migrations: What to Check Before You Install

Most FiveM script problems that show up a week after the install are not script bugs. They are database problems, and th

The insurance edge case that breaks event-driven policy pipelines

The insurance edge case that breaks event-driven policy pipelines

If you're moving insurance policy data from a nightly batch to an event stream, the broker is the easy part. The hard pa

The fix for an empty state isn't filling it

The fix for an empty state isn't filling it

Last week I posted on Indie Hackers about a decision in my renovation cost tool: it ships with an empty price book. The

Five Things That Make Dependabot Painful for Terraform

Five Things That Make Dependabot Painful for Terraform

A Terraform block in dependabot.yml looks identical to an npm or uv one: - package-ecosystem : terraform directory : /te

Tracking Roblox player counts: what the public data actually gives you

Tracking Roblox player counts: what the public data actually gives you

Roblox does not publish a public API for per-game concurrent player counts, so anything you see is a sample. I have been

Telegram gold signals this week: results to Oct 30

From October 24 to October 30, we executed 3,629 signals from 405 Telegram gold channels at the broker. More channels ma