Information Disclosure Vulnerability in Atlantis by Runatlantis

CVE-2025-58445

What is CVE-2025-58445?

Atlantis, a self-hosted application built with Golang for managing Terraform pull requests, exposes sensitive version information through its /status endpoint. This security flaw allows potential attackers to gain insights into the versions in use, which may lead to the identification of other vulnerabilities associated with those specific versions. This exposure can significantly compromise the security of the service by making it easier for malicious actors to exploit known vulnerabilities. Currently, there is no fix available for this issue.

References