CVE-2026-71494

Name of the Vulnerable Software and Affected Versions Infracost versions prior to 0.10.45

Description Infracost allows the attachment of a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without verifying if the host is trusted. This occurs within internal/hcl/remote variables loader.go and request paths related to Terraform Cloud, remote-plan, and the Terragrunt registry. An attacker providing malicious Terraform input during a CI run that includes a token, such as through pull request target or a same-repository pull request, can redirect the request to a host under their control to disclose the token. Standard fork pull request workflows that do not use secrets are not affected.

Recommendations Update to version 0.10.45.