CVE-2026-71494: Infracost

Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days.

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.

Affected products

• Infracost Infracost: before 0.10.45 (fixed in 0.10.45)

Published 2026-08-21. Last modified 2026-09-18.