Git credentials are exposed in Atlantis logs (CVE-2024-52009)
Atlantis versions prior to 0.30.0 log GitHub tokens in plaintext during token rotation. This exposure in logs can allow unauthorized users with log access to impersonate the Atlantis application and perform privileged actions on GitHub organizations managed by Atlantis. The vulnerability was fixed in Atlantis v0.30.0.
AI Analysis
Technical Summary
Atlantis, when used to manage GitHub organizations, logged sensitive GitHub tokens (starting with 'ghs_') in its debug logs during token rotation. These logs were accessible to users with read-only access to Argo CD, enabling them to obtain administration privileges on the GitHub organization and potentially escalate to cluster admin privileges on Kubernetes clusters managed via Infrastructure-as-Code. The issue was reported and fixed in pull request 4667, included in Atlantis v0.30.0. No official security advisory or CVE was initially published, but this vulnerability is tracked as CVE-2024-52009.
Potential Impact
Exposure of GitHub tokens in logs allows attackers with read access to logs to impersonate Atlantis and perform administrative actions on GitHub organizations. This compromises repository security and can lead to further privilege escalation in Kubernetes environments managed through Atlantis. The vulnerability affects users deploying Atlantis with GitHub integration and token rotation enabled.
Mitigation Recommendations
Upgrade Atlantis to version 0.30.0 or later, where the logging of GitHub tokens during rotation has been fixed. Avoid granting unnecessary log read access to users. Patch status is confirmed fixed in Atlantis v0.30.0.
Git credentials are exposed in Atlantis logs (CVE-2024-52009)
Description
Atlantis versions prior to 0.30.0 log GitHub tokens in plaintext during token rotation. This exposure in logs can allow unauthorized users with log access to impersonate the Atlantis application and perform privileged actions on GitHub organizations managed by Atlantis. The vulnerability was fixed in Atlantis v0.30.0.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Atlantis, when used to manage GitHub organizations, logged sensitive GitHub tokens (starting with 'ghs_') in its debug logs during token rotation. These logs were accessible to users with read-only access to Argo CD, enabling them to obtain administration privileges on the GitHub organization and potentially escalate to cluster admin privileges on Kubernetes clusters managed via Infrastructure-as-Code. The issue was reported and fixed in pull request 4667, included in Atlantis v0.30.0. No official security advisory or CVE was initially published, but this vulnerability is tracked as CVE-2024-52009.
Potential Impact
Exposure of GitHub tokens in logs allows attackers with read access to logs to impersonate Atlantis and perform administrative actions on GitHub organizations. This compromises repository security and can lead to further privilege escalation in Kubernetes environments managed through Atlantis. The vulnerability affects users deploying Atlantis with GitHub integration and token rotation enabled.
Mitigation Recommendations
Upgrade Atlantis to version 0.30.0 or later, where the logging of GitHub tokens during rotation has been fixed. Avoid granting unnecessary log read access to users. Patch status is confirmed fixed in Atlantis v0.30.0.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-gppm-hq3p-h4rp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2024-52009"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- HIGH
- Cvss Version
- 4.0
Threat ID: 6a3ef78c27e9c79719ff48b1
Added to database: 06/26/2026, 22:05:00 UTC
Last enriched: 06/26/2026, 22:15:13 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 17
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.