{"id":"CVE-2026-71494","title":"Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD","summary":"Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a…","severity":"medium","cwe":["CWE-522"],"vendor":"infracost","product":"github.com/infracost/infracost","affected":["github.com/infracost/infracost < 0.10.45"],"patched":["github.com/infracost/infracost 0.10.45"],"published":"2026-08-21","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71494","references":[{"url":"https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f","label":"security-advisories@github.com"},{"url":"https://github.com/infracost/infracost/pull/3590","label":"security-advisories@github.com"},{"url":"https://github.com/infracost/infracost/releases/tag/v0.10.45","label":"security-advisories@github.com"},{"url":"https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71494"},{"url":"https://github.com/infracost/infracost"},{"url":"https://github.com/advisories/GHSA-6x6c-w9w9-hv4h"}],"tags":["nvd","osv","go","ghsa"],"epss":0.00367,"epssPercentile":0.3038,"aliases":["GHSA-6x6c-w9w9-hv4h","GO-2026-6437"],"ecosystem":"go","ingestedAt":"2026-09-08T19:08:49.635Z","slug":"CVE-2026-71494","body":"## Overview\n\nInfracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71494)\n\nAffected packages:\n\n- `github.com/infracost/infracost < 0.10.45`\n\nPatched in:\n\n- `github.com/infracost/infracost 0.10.45`\n\nSource: https://osv.dev/vulnerability/GHSA-6x6c-w9w9-hv4h","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}