{"id":"EUVD-2026-64019","enisaUuid":"e3f64f49-1229-3225-b277-c9d79f2b6301","description":"Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.","datePublished":"Aug 21, 2026, 5:50:43 PM","dateUpdated":"Aug 21, 2026, 7:23:57 PM","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h\nhttps://github.com/infracost/infracost/pull/3590\nhttps://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f\nhttps://github.com/infracost/infracost/releases/tag/v0.10.45\n","aliases":"CVE-2026-71494\nGHSA-6x6c-w9w9-hv4h\n","assigner":"GitHub_M","epss":0.5,"enisaIdProduct":[{"id":"3314c990-c376-3b03-9075-7265c8cb7dae","product":{"name":"infracost","vendor":{"name":"infracost"}},"product_version":"\u003c 0.10.45"}],"enisaIdVendor":[{"id":"25af0c66-7e8a-34b1-a0b6-543c034d903b","vendor":{"name":"infracost"}}],"enisaIdVulnerability":[{"id":"90cc520f-2275-3b79-9632-5e26d193e39c","vulnerability":{"id":"GHSA-6x6c-w9w9-hv4h","description":"Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname","datePublished":"Sep 8, 2026, 6:14:12 PM","dateUpdated":"Sep 8, 2026, 6:14:12 PM","baseScore":0.0,"references":"https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71494\nhttps://github.com/infracost/infracost/pull/3590\nhttps://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f\nhttps://github.com/infracost/infracost\nhttps://github.com/infracost/infracost/releases/tag/v0.10.45\n","enisa_id":"EUVD-2026-64019\n","aliases":"CVE-2026-71494\nGHSA-6x6c-w9w9-hv4h\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:05:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f01afdc9-ada1-3966-b087-ac68aa419c14","vulnerability":{"id":"CVE-2026-71494","description":"Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.","datePublished":"Aug 21, 2026, 5:50:43 PM","dateUpdated":"Aug 21, 2026, 7:23:57 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h\nhttps://github.com/infracost/infracost/pull/3590\nhttps://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f\nhttps://github.com/infracost/infracost/releases/tag/v0.10.45\n","enisa_id":"EUVD-2026-64019\n","assigner":"GitHub_M","epss":0.5,"dataProcessed":"Nov 7, 2026, 7:17:41 AM","vulnerabilityProduct":[{"id":"5c75bd12-bb07-3de3-ada9-474de8b391a3","product":{"name":"infracost","vendor":{"name":"infracost"}},"product_version":"\u003c 0.10.45"}],"vulnerabilityVendor":[{"id":"db3a01e7-5654-37ef-9b53-e8e1713a1fc6","vendor":{"name":"infracost"}}]}}],"enisaIdAdvisory":[]}