CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Attackers can steal Terraform Cloud or registry tokens by directing requests to malicious hosts via unvalidated hostnames in CI workflows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-71494?
CVE-2026-71494 is a medium-severity vulnerability in infracost, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.
Weakness: CWE-522
Which versions are affected by CVE-2026-71494?
3 open source packages ship an affected version, including github.com/infracost/infracost.
| Package | Affected | Fixed in |
|---|---|---|
github.com/infracost/infracost Go | All versions | 0.10.45 |
github.com/infracost/infracost Go | All versions | 0.10.45 |
github.com/infracost/infracost Go | All versions | 0.10.45 |
How do I fix CVE-2026-71494?
Upgrade github.com/infracost/infracost to 0.10.45 or later.
Is CVE-2026-71494 being exploited?
There is no known exploitation of CVE-2026-71494 in the wild and no public exploit code.
Sources
Also known as GHSA-6x6c-w9w9-hv4h, GO-2026-6437.