CVE-2025-58445 - Atlantis Exposes Service Version Publicly on /status API Endpoint

Back Back to CVE browser

MEDIUM

Atlantis Exposes Service Version Publicly on /status API Endpoint

Published Sep 6, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.46%

Description

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known vulnerabilities associated with the specific versions, potentially compromising the service's security posture. This issue does not currently have a fix.

Affected products

Vendor Runatlantis Product Atlantis Default
n/a
- Version
  <= 0.35.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Runatlantis

Atlantis

n/a

Version	Status	Constraints
<= 0.35.1	affected	-

Ecosystem	Package	Introduced	Fixed
Go	github.com/runatlantis/atlantis	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27088
Advisory
https://github.com/advisories/GHSA-xh7v-965r-23f7
Advisory
https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7
exploitx_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-58445

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-27088		Advisory
https://github.com/advisories/GHSA-xh7v-965r-23f7		Advisory
https://github.com/runatlantis/atlantis/security/advisories/GHSA-xh7v-965r-23f7		exploitx_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-58445