CVE-2026-71493: Infracost Path Traversal Vulnerability

CVE-2026-71493 Overview

CVE-2026-71493 is a path traversal vulnerability [CWE-22] in Infracost, a cloud cost intelligence tool for engineers, AI coding agents, and CI/CD pipelines. Versions prior to 0.10.45 fail to resolve intermediate directory symlinks in the readFile, pathExists, isDir, and matchPaths template functions within internal/config/template/parser.go. A malicious repository can plant a symlink that points outside the checkout, causing Infracost to read files accessible to the CI/CD runner. The disclosed content is rendered into generated configuration and surfaced through the Infracost dashboard or pull request comments.

Critical Impact
Attackers who submit a crafted repository or pull request can exfiltrate runner-accessible files, including repository secrets used in CI/CD workflows.

Affected Products

Infracost versions prior to 0.10.45
Infracost CLI integrations in CI/CD pipelines (GitHub Actions, GitLab CI, and equivalents)
Infracost pull request comment and dashboard workflows

Discovery Timeline

2026-08-21 - CVE-2026-71493 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71493

Vulnerability Analysis

The flaw resides in the template parser in internal/config/template/parser.go. The functions readFile, pathExists, isDir, and matchPaths enforce path confinement using a lexical filepath.Rel check combined with a leaf-only os.Lstat check. Neither check resolves intermediate directory symlinks. When Infracost evaluates a path such as evil/file, it inspects only the final path component with Lstat. If evil is a symlink pointing outside the repository checkout, os.ReadFile and related calls follow the symlink and read files on the runner filesystem.

The returned content is embedded into generated Infracost configuration. That configuration is later rendered into pull request comments and the Infracost dashboard, giving the attacker a channel to observe the file contents. In workflows that expose secrets to the Infracost step, environment files and credential material become reachable.

Root Cause

The confinement logic performs string-based relative-path validation and terminal symlink inspection without walking each directory component. Go's filepath.Rel operates on lexical paths and does not consult the filesystem, so a symlink embedded in an intermediate directory is invisible to the check. This is a classic TOCTOU-adjacent path traversal pattern in which validation and use operate on different views of the path.

Attack Vector

An attacker with the ability to influence the repository contents, typically through a pull request from a fork or a contributed branch, plants a symlink named as a directory. When the Infracost CI/CD step runs, the template functions dereference the symlink and read arbitrary files reachable by the runner user. Exfiltration occurs when Infracost posts the generated output to the pull request comment or the dashboard.

// Security patch in internal/config/template/parser.go
 	"github.com/infracost/infracost/internal/config"
 	"github.com/infracost/infracost/internal/logging"
+	"github.com/infracost/infracost/internal/security"
 )

// Source: https://github.com/infracost/infracost/commit/4d39331afc0e27752d16d9d91c34583e5e8487fb

The patch introduces a dedicated internal/security package to centralize path confinement. A parallel change in internal/hcl/funcs/filesystem.go removes the strings-based comparison in favor of resolved-path handling, ensuring intermediate symlinks are evaluated before file operations proceed.

Detection Methods for CVE-2026-71493

Indicators of Compromise

Pull requests that add symbolic links referenced by Infracost template files such as infracost.yml or infracost-usage.yml.
Infracost pull request comments or dashboard entries containing content from paths outside the repository, such as /etc/, /home/runner/, or .env file fragments.
CI/CD job logs showing Infracost readFile, pathExists, isDir, or matchPaths calls resolving to absolute paths outside the checkout directory.

Detection Strategies

Audit repository contents for symbolic links using find . -type l in CI/CD preflight checks before invoking Infracost.
Inspect Infracost-generated configuration artifacts for unexpected file content that does not originate from repository sources.
Correlate Infracost step outputs with pull request diffs to identify content injected via symlink dereferencing.

Monitoring Recommendations

Enable verbose logging in the Infracost CLI and forward CI/CD job logs to a centralized log store for retention and search.
Monitor pull request comment activity from bot accounts for unusual content sizes or file-path signatures.
Alert on Infracost runs triggered by pull requests from forked repositories, which represent the primary attack surface.

How to Mitigate CVE-2026-71493

Immediate Actions Required

Upgrade Infracost to version 0.10.45 or later across all CI/CD environments and developer workstations.
Rotate any secrets that were accessible to the Infracost runner user during the exposure window, including cloud credentials and API tokens.
Restrict pull request workflows from forks so that Infracost does not receive repository secrets on untrusted events.

Patch Information

The vulnerability is fixed in Infracost Release v0.10.45. The corrective changes are tracked in GitHub Pull Request #3586 and applied in this commit. Additional context is available in the GitHub Security Advisory GHSA-mmg6-4qmv-6pc8.

Workarounds

Run Infracost inside an ephemeral, minimal container without access to host secrets or sensitive filesystem paths.
Configure CI/CD to execute Infracost only on pull_request_target equivalents that withhold secrets when the source branch is untrusted.
Add a preflight step that fails the build when repository contents include symbolic links inside directories consumed by Infracost templates.

bash

# Preflight check to reject symlinks before running Infracost
if find . -type l -not -path './.git/*' | grep -q .; then
  echo 'Symbolic links detected in repository. Aborting Infracost run.'
  exit 1
fi

# Upgrade Infracost to the patched release
curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | sh -s -- --version v0.10.45
infracost --version