CVE-2026-71494: Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pullrequesttarget or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pullrequest workflows without secrets are not exposed. This issue is fixed in version 0.10.45.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Infracostto a version that resolves this vulnerability.Fixed in 0.10.45
Event History
Frequently Asked Questions
Which CI workflows are realistically exposed?
CI runs that provide a Terraform Cloud or registry token while scanning attacker-controlled Terraform are exposed. This includes pull_request_target workflows and same-repository pull requests; standard fork pull_request workflows without secrets are not exposed.
What must an attacker control to disclose a token?
The attacker needs to supply Terraform input that influences a destination hostname used by the affected Terraform Cloud, remote-plan, Terragrunt registry, or related request paths. The CI run must also make a configured Terraform Cloud or registry token available to Infracost.
How can this be remediated?
Upgrade Infracost to version 0.10.45, which fixes the hostname validation issue. If upgrading cannot happen immediately, avoid providing Terraform Cloud or registry tokens to runs that scan attacker-controlled Terraform, particularly pull_request_target and same-repository pull request workflows.