CVE-2026-71494 - Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Brief
CVE ID : CVE-2026-71494
Published : Aug. 21, 2026, 6:16 p. m.
- 53 minutes ago
Description : Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.
- 45, internal/hcl/remote_variables_loader.
go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host.
When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.
- 45.
Severity: 5.9
- MEDIUM