CVE-2026-71494

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.

• CWE-522

• https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f
• https://github.com/infracost/infracost/pull/3590
• https://github.com/infracost/infracost/releases/tag/v0.10.45
• https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h

Published

Aug 21, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71486vLLM is an inference and serving engine for large language m…4.3
• CVE-2026-71488league/commonmark is a PHP library for parsing and rendering…7.5
• CVE-2026-7149A vulnerability has been found in dexhunter kaggle-mcp up to…7.3
• CVE-2026-71491sqlparse is a non-validating SQL parser module for Python. P…8.7
• CVE-2026-71492Banks generates meaningful LLM prompts using a simple templa…6
• CVE-2026-71493Infracost provides cloud cost intelligence for engineers, AI…5.9
• CVE-2026-71497jsoup is a Java library for working with real-world HTML. Fr…4.7
• CVE-2026-71498node-re2 provides RE2 regular expression bindings for Node.j…5.1
• CVE-2026-7150A vulnerability was found in dh1011 auto-favicon up to f1891…6.3
• CVE-2026-71502CTI-Transmute contains a stored cross-site scripting vulnera…5.1
• CVE-2026-71503Dolibarr before 24.0.0 contains a reflected cross-site scrip…6.1
• CVE-2026-71504Dolibarr before 24.0.0 contains an improper authorization vu…8.1