Download Latest Version atlantis_linux_386.zip (15.6 MB) Google Add to Preferred Sources
Home / v0.48.2
Name Modified Size InfoDownloads / Week
Parent folder
checksums.txt 2026-10-21 728 Bytes
0
atlantis_darwin_amd64.zip 2026-10-21 17.1 MB
0
atlantis_linux_arm64.zip 2026-10-21 14.9 MB
0
atlantis_linux_arm.zip 2026-10-21 15.5 MB
0
atlantis_darwin_arm64.zip 2026-10-21 15.8 MB
0
atlantis_linux_386.zip 2026-10-21 15.6 MB
0
atlantis_linux_amd64.zip 2026-10-21 16.7 MB
0
atlantis_windows_386.zip 2026-10-21 16.3 MB
0
atlantis_windows_amd64.zip 2026-10-21 17.1 MB
0
README.md 2026-10-21 2.3 kB
0
v0.48.2 source code.tar.gz 2026-10-21 14.0 MB
0
v0.48.2 source code.zip 2026-10-21 14.7 MB
0
Totals: 12 Items   157.6 MB 0

Highlights

Emergency security release for the eMudhra intermediate CA key compromise. The private keys of eight eMudhra (emSign) intermediate certificates were compromised; some of those intermediates are cross-signed by a root that every trust store includes. We recommend all users upgrade.

  • Go 1.27.3: Atlantis is now built with go1.27.3, whose crypto/x509 rejects any certificate chain containing the eight compromised keys (CVE-2026-111943). Go does not check revocation, so Atlantis v0.48.1 and earlier, built with go1.27.1, would accept a certificate issued with those keys for any host, including the VCS APIs Atlantis sends credentials to. go1.27.3 also includes the standard library fixes from go1.27.2.
  • Trust store update in the images: ca-certificates is updated to Alpine 20261020-r0 and Debian 20250419+deb13u1. Both remove emSign ECC Root CA - G3, and Debian also removes the Comodo AAA Services root that cross-signed some of the affected intermediates. This covers the other TLS clients in the image (git, curl, Terraform/OpenTofu and conftest).
  • Runtime image refresh: Debian curl 8.14.1-2+deb13u7 and openssl 3.5.7-1~deb13u3 security pins, Alpine 3.24.2, Terraform 1.16.5, conftest 0.70.1.
  • Dependency security updates: golang.org/x/net v0.60.0 and vite v8.3.3.

If you build Atlantis yourself, rebuild with go1.27.3 or go1.26.10 or later. The terraform, tofu and conftest binaries are built by their own projects; update them when their releases with the Go fix are available.

What's Changed

Security changes

Full Changelog: https://github.com/runatlantis/atlantis/compare/v0.48.1...v0.48.2

Source: README.md, updated 2026-10-21