CVE-2026-71494: Infracost Token Disclosure Vulnerability

CVE-2026-71494 Overview

CVE-2026-71494 is a credential exposure vulnerability in Infracost, a cloud cost intelligence tool used by engineers, AI coding agents, and CI/CD pipelines. The flaw exists in internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths. Infracost versions prior to 0.10.45 attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without verifying the destination matches the configured trusted host. An attacker who controls Terraform inputs processed in a CI run can redirect authenticated requests to an attacker-controlled host, disclosing the token. The issue is tracked under [CWE-522: Insufficiently Protected Credentials].

Critical Impact
Attackers can exfiltrate Terraform Cloud or registry tokens by supplying malicious Terraform configurations to Infracost scans executed in privileged CI contexts.

Affected Products

Infracost versions prior to 0.10.45
CI/CD workflows using Infracost with pull_request_target triggers or same-repository pull requests that expose secrets
Infracost scans configured with Terraform Cloud or registry tokens

Discovery Timeline

2026-08-21 - CVE-2026-71494 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-71494

Vulnerability Analysis

Infracost loads remote variables from Terraform Cloud and fetches modules from Terraform registries when scanning Terraform configurations. To authenticate these requests, the tool accepts a configured hostname and token pair. The vulnerable code paths in internal/hcl/remote_variables_loader.go and related remote-plan and Terragrunt registry loaders derive the destination hostname from the Terraform input under scan. When that input is attacker-controlled, the derived hostname can point anywhere on the internet.

The token attachment logic did not confirm that the derived hostname matched the trusted host associated with the token. As a result, Infracost would send the configured Terraform Cloud or registry token to an arbitrary host chosen by the attacker. The attacker's server records the Authorization header and gains access to the token.

Root Cause

The root cause is missing host validation prior to authenticated request emission. The authenticated API client did not expose or check its configured host against the outgoing request target. The patched AuthedAPIClient adds a Host() accessor and threads a hostConfigured flag through OptionWithTFCRemoteVarLoader so the loader can reject requests whose destination host does not match the explicitly configured trusted host.

Attack Vector

Exploitation requires a CI environment where Infracost runs with a Terraform Cloud or registry token available as a secret, and where the workflow processes attacker-controllable Terraform. This occurs most commonly with pull_request_target triggers or same-repository pull requests where secrets are exposed. Standard fork pull_request workflows that run without secrets are not exposed. The attacker submits a Terraform configuration that causes Infracost to resolve a remote variable, remote plan, or registry module against an attacker-controlled hostname. Infracost then transmits the token in the request headers to that host.

// Patched code: AuthedAPIClient exposes its trusted host so callers
// can verify the destination before attaching tokens.
// Source: https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f

// Host returns the trusted host that the authed API client sends
// authenticated requests to.
func (a *AuthedAPIClient) Host() string {
	return a.host
}

// SetHost sets the host for base host for the authed API client.
func (a *AuthedAPIClient) SetHost(host string) {
	a.host = host

// Patched OptionWithTFCRemoteVarLoader accepts a hostConfigured flag
// so the loader can enforce host scoping when the user explicitly set the host.
// Source: https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f

// OptionWithTFCRemoteVarLoader accepts Terraform Cloud/Enterprise host and token
// values to load remote execution variables. hostConfigured indicates whether
// the host was explicitly set by the user (rather than defaulted to
// app.terraform.io), which controls how the loader handles a mismatching host
// in the scanned Terraform.
func OptionWithTFCRemoteVarLoader(host, token, localWorkspace string, hostConfigured bool, loaderOpts ...TFCRemoteVariablesLoaderOption) Option {
	return func(p *Parser) {
		if host == "" || token == "" {
			return
		}

		client := extclient.NewAuthedAPIClient(host, token)
		p.remoteVariableLoaders = append(p.remoteVariableLoaders, NewTFCRemoteVariablesLoader(client, localWorkspace, hostConfigured, p.logger, loaderOpts...))
	}
}

Detection Methods for CVE-2026-71494

Indicators of Compromise

Outbound HTTPS requests from CI runners to hostnames that do not match app.terraform.io or your configured Terraform Enterprise or registry host during Infracost execution.
Terraform configurations in pull requests that reference unfamiliar hostname values in terraform { cloud { ... } } blocks or module source URLs.
CI job logs showing Infracost resolving remote variables or modules against unexpected external domains.

Detection Strategies

Inspect CI/CD workflow definitions for pull_request_target triggers combined with Infracost invocations that receive INFRACOST_TERRAFORM_CLOUD_TOKEN or registry tokens.
Audit git history for pull requests that modified Terraform files to introduce new cloud, backend, or module source hostnames.
Compare the version of Infracost pinned in CI pipelines against 0.10.45 and flag any earlier releases.

Monitoring Recommendations

Enable egress filtering on CI runners so Infracost can only reach approved Terraform Cloud, Enterprise, and registry hosts.
Alert on any Infracost process that establishes TLS connections to hosts outside an allowlist.
Continuously monitor Terraform Cloud audit logs for token usage originating from unexpected IP addresses.

How to Mitigate CVE-2026-71494

Immediate Actions Required

Upgrade Infracost to version 0.10.45 or later across all CI/CD runners and local developer environments.
Rotate any Terraform Cloud, Terraform Enterprise, and Terraform registry tokens previously used with vulnerable Infracost versions in workflows that scan untrusted Terraform.
Review recent CI runs for pull_request_target events or same-repository pull requests that executed Infracost with secrets attached.

Patch Information

The fix is delivered in Infracost 0.10.45. The patch introduces host scoping for authenticated requests, adds a Host() accessor on AuthedAPIClient, and threads a hostConfigured flag through OptionWithTFCRemoteVarLoader so tokens are only attached when the outbound request targets the explicitly configured trusted host. See the Infracost v0.10.45 release notes, pull request #3590, and GHSA-6x6c-w9w9-hv4h security advisory.

Workarounds

Remove pull_request_target triggers from workflows that invoke Infracost, or strip Terraform Cloud and registry tokens from those jobs until upgrading.
Restrict Infracost CI jobs on same-repository pull requests to trusted contributors using branch protection and required reviews.
Apply CI runner egress allowlists that limit outbound traffic to your known Terraform Cloud, Enterprise, and registry hostnames.

bash

# Pin Infracost to the fixed version in CI
# Example: GitHub Actions using the official Infracost action
- name: Setup Infracost
  uses: infracost/actions/setup@v3
  with:
    api-key: ${{ secrets.INFRACOST_API_KEY }}
    version: 0.10.45

# Verify installed version at runtime
infracost --version | grep -E "0\.10\.(4[5-9]|[5-9][0-9])" \
  || { echo "Infracost version is vulnerable to CVE-2026-71494"; exit 1; }