CVE-2026-71494
Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.
| CWE | CWE-522 |
| Vendor | infracost |
| Product | infracost |
| Published | Aug 21, 2026 |
| Last Updated | Aug 21, 2026 |
Get instant alerts for infracost infracost
Be the first to know when new unknown vulnerabilities affecting infracost infracost are published — delivered to Slack, Telegram or Discord.