CVE-2026-71494

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.

CVSS

No CVSS.

References

Link	Resource
https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f
https://github.com/infracost/infracost/pull/3590
https://github.com/infracost/infracost/releases/tag/v0.10.45
https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h

Configurations

No configuration.

History

14 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Infracost proporciona inteligencia de costos en la nube para ingenieros, agentes de codificación de IA y CI/CD. Antes de la versión 0.10.45, internal/hcl/remote_variables_loader.go y las rutas de solicitud relacionadas de Terraform Cloud, remote-plan y el registro de Terragrunt pueden adjuntar un token configurado de Terraform Cloud o de registro a un nombre de host de destino derivado de una entrada de Terraform no confiable sin confirmar que sea el host confiable configurado. Cuando una ejecución de CI proporciona un token mientras escanea Terraform controlado por el atacante, incluyendo pull_request_target o una solicitud de extracción del mismo repositorio, un atacante puede dirigir la solicitud a un host controlado por el atacante y divulgar el token. Los flujos de trabajo estándar de solicitud de extracción de bifurcación sin secretos no están expuestos. Este problema está solucionado en la versión 0.10.45.

Information

Published : 2026-08-21 18:16

Updated : 2026-10-14 19:10

NVD link : CVE-2026-71494

Mitre link : CVE-2026-71494

CVE.ORG link : CVE-2026-71494

JSON object : View

Products Affected

No product.

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-71494", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71494", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:23:15.884212Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "infracost", "product": "infracost", "versions": [{"status": "affected", "version": "< 0.10.45"}]}]}], "published": "2026-08-21T18:16:50.590", "references": [{"url": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f", "source": "security-advisories@github.com"}, {"url": "https://github.com/infracost/infracost/pull/3590", "source": "security-advisories@github.com"}, {"url": "https://github.com/infracost/infracost/releases/tag/v0.10.45", "source": "security-advisories@github.com"}, {"url": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45."}, {"lang": "es", "value": "Infracost proporciona inteligencia de costos en la nube para ingenieros, agentes de codificaci\u00f3n de IA y CI/CD. Antes de la versi\u00f3n 0.10.45, internal/hcl/remote_variables_loader.go y las rutas de solicitud relacionadas de Terraform Cloud, remote-plan y el registro de Terragrunt pueden adjuntar un token configurado de Terraform Cloud o de registro a un nombre de host de destino derivado de una entrada de Terraform no confiable sin confirmar que sea el host confiable configurado. Cuando una ejecuci\u00f3n de CI proporciona un token mientras escanea Terraform controlado por el atacante, incluyendo pull_request_target o una solicitud de extracci\u00f3n del mismo repositorio, un atacante puede dirigir la solicitud a un host controlado por el atacante y divulgar el token. Los flujos de trabajo est\u00e1ndar de solicitud de extracci\u00f3n de bifurcaci\u00f3n sin secretos no est\u00e1n expuestos. Este problema est\u00e1 solucionado en la versi\u00f3n 0.10.45."}], "lastModified": "2026-10-14T19:10:00.297", "sourceIdentifier": "security-advisories@github.com"}