{"id":"CVE-2026-71494","sourceIdentifier":"security-advisories@github.com","published":"2026-08-21T18:16:50.590","lastModified":"2026-10-14T19:10:00.297","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45."},{"lang":"es","value":"Infracost proporciona inteligencia de costos en la nube para ingenieros, agentes de codificación de IA y CI/CD. Antes de la versión 0.10.45, internal/hcl/remote_variables_loader.go y las rutas de solicitud relacionadas de Terraform Cloud, remote-plan y el registro de Terragrunt pueden adjuntar un token configurado de Terraform Cloud o de registro a un nombre de host de destino derivado de una entrada de Terraform no confiable sin confirmar que sea el host confiable configurado. Cuando una ejecución de CI proporciona un token mientras escanea Terraform controlado por el atacante, incluyendo pull_request_target o una solicitud de extracción del mismo repositorio, un atacante puede dirigir la solicitud a un host controlado por el atacante y divulgar el token. Los flujos de trabajo estándar de solicitud de extracción de bifurcación sin secretos no están expuestos. Este problema está solucionado en la versión 0.10.45."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"infracost","product":"infracost","versions":[{"version":"< 0.10.45","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":5.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-21T19:23:15.884212Z","id":"CVE-2026-71494","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-522"}]}],"references":[{"url":"https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f","source":"security-advisories@github.com"},{"url":"https://github.com/infracost/infracost/pull/3590","source":"security-advisories@github.com"},{"url":"https://github.com/infracost/infracost/releases/tag/v0.10.45","source":"security-advisories@github.com"},{"url":"https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h","source":"security-advisories@github.com"}]}