CVE-2026-71494
Received Received - Intake

Infracost Token Exposure via Untrusted Terraform Input

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-71494
EUVD
EUVD-2026-64019

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
infracost infracost to 0.10.45 (exc)
infracost infracost to 0.10.45 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Infracost versions before 0.10.45. It allows tokens for Terraform Cloud or registry to be sent to untrusted hosts derived from attacker-controlled Terraform input. An attacker can manipulate Terraform configurations in pull requests to redirect requests to their own domain, causing tokens to be exposed as Bearer credentials.

Detection Guidance

Check Infracost version with 'infracost --version'. If it is below 0.10.45, the system is vulnerable. Review CI logs for HTTP requests to untrusted hosts during Terraform scans, especially in pull_request_target workflows.

Impact Analysis

If you use Infracost with Terraform Cloud or registry tokens in CI/CD pipelines, an attacker could steal these tokens by submitting malicious Terraform code in a pull request. This could lead to unauthorized access to your cloud resources or infrastructure.

Compliance Impact

Token exposure could violate compliance requirements for protecting sensitive credentials. GDPR and HIPAA mandate safeguarding personal and health data, which may include access credentials. Unauthorized token disclosure could lead to regulatory penalties or data breaches.

Mitigation Strategies

Upgrade Infracost to version 0.10.45 or later. Avoid using pull_request_target workflows with secrets. Configure TERRAFORM_CLOUD_HOST to restrict token scope. Review and restrict untrusted Terraform content in CI pipelines.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71494. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart