{"id":"CVE-2026-71494","revision":"416e914913aa42dea8ac059137e6a57b","records":[{"revision":"416e914913aa42dea8ac059137e6a57b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-71494","aliases":[],"title":"Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname","description":"Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.","state":0,"publishedAt":"2026-08-21T17:50:43.655+00:00","modifiedAt":"2026-08-21T19:23:57.52+00:00","affected":[{"ecosystem":"Vendor product","name":"infracost","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"infracost\",\n                    \"product\": \"infracost\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.10.45\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h","https://github.com/infracost/infracost/pull/3590","https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f","https://github.com/infracost/infracost/releases/tag/v0.10.45"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-71494","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-71494","identifiers":["CVE-2026-71494"]},"retained":false,"historicalAffected":[]}],"coverage":[]}