CVE-2026-71493 Infracost: Arbitrary file read via config-template readFile symlink traversal
Attackers can read arbitrary files via symlink traversal in Infracost templates, potentially exposing secrets in CI/CD workflows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-71493?
CVE-2026-71493 is a medium-severity path traversal vulnerability in infracost, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45.
Which versions are affected by CVE-2026-71493?
3 open source packages ship an affected version, including github.com/infracost/infracost.
| Package | Affected | Fixed in |
|---|---|---|
github.com/infracost/infracost Go | All versions | 0.10.45 |
github.com/infracost/infracost Go | All versions | 0.10.45 |
github.com/infracost/infracost Go | All versions | 0.10.45 |
How do I fix CVE-2026-71493?
Upgrade github.com/infracost/infracost to 0.10.45 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-71493 being exploited?
There is no known exploitation of CVE-2026-71493 in the wild and no public exploit code.
Sources
Also known as GHSA-mmg6-4qmv-6pc8, GO-2026-6439.