CVE-2026-71494

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71494", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-06T19:56:23.725Z", "datePublished": "2026-08-21T17:50:43.655Z", "dateUpdated": "2026-08-21T19:23:57.520Z"}, "containers": {"cna": {"title": "Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname", "problemTypes": [{"descriptions": [{"cweId": "CWE-522", "lang": "en", "description": "CWE-522: Insufficiently Protected Credentials", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h"}, {"name": "https://github.com/infracost/infracost/pull/3590", "tags": ["x_refsource_MISC"], "url": "https://github.com/infracost/infracost/pull/3590"}, {"name": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f", "tags": ["x_refsource_MISC"], "url": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f"}, {"name": "https://github.com/infracost/infracost/releases/tag/v0.10.45", "tags": ["x_refsource_MISC"], "url": "https://github.com/infracost/infracost/releases/tag/v0.10.45"}], "affected": [{"vendor": "infracost", "product": "infracost", "versions": [{"version": "< 0.10.45", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T17:50:43.655Z"}, "descriptions": [{"lang": "en", "value": "Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45."}], "source": {"advisory": "GHSA-6x6c-w9w9-hv4h", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T19:23:15.884212Z", "id": "CVE-2026-71494", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:23:57.520Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71494", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T19:23:15.884212Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T19:23:40.787Z"}}], "cna": {"title": "Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname", "source": {"advisory": "GHSA-6x6c-w9w9-hv4h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "infracost", "product": "infracost", "versions": [{"status": "affected", "version": "< 0.10.45"}]}], "references": [{"url": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h", "name": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/infracost/infracost/pull/3590", "name": "https://github.com/infracost/infracost/pull/3590", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f", "name": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/infracost/infracost/releases/tag/v0.10.45", "name": "https://github.com/infracost/infracost/releases/tag/v0.10.45", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522: Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-21T17:50:43.655Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71494", "state": "PUBLISHED", "dateUpdated": "2026-08-21T19:23:57.520Z", "dateReserved": "2026-08-06T19:56:23.725Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-21T17:50:43.655Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "infracost", "vendor": "infracost", "versions": [{"status": "affected", "version": "< 0.10.45"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45."}, {"lang": "es", "value": "Infracost proporciona inteligencia de costos en la nube para ingenieros, agentes de codificaci\u00f3n de IA y CI/CD. Antes de la versi\u00f3n 0.10.45, internal/hcl/remote_variables_loader.go y las rutas de solicitud relacionadas de Terraform Cloud, remote-plan y el registro de Terragrunt pueden adjuntar un token configurado de Terraform Cloud o de registro a un nombre de host de destino derivado de una entrada de Terraform no confiable sin confirmar que sea el host confiable configurado. Cuando una ejecuci\u00f3n de CI proporciona un token mientras escanea Terraform controlado por el atacante, incluyendo pull_request_target o una solicitud de extracci\u00f3n del mismo repositorio, un atacante puede dirigir la solicitud a un host controlado por el atacante y divulgar el token. Los flujos de trabajo est\u00e1ndar de solicitud de extracci\u00f3n de bifurcaci\u00f3n sin secretos no est\u00e1n expuestos. Este problema est\u00e1 solucionado en la versi\u00f3n 0.10.45."}], "id": "CVE-2026-71494", "lastModified": "2026-10-14T19:10:00.297", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71494", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T19:23:15.884212Z", "version": "2.0.3"}}]}, "published": "2026-08-21T18:16:50.590", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f"}, {"source": "security-advisories@github.com", "url": "https://github.com/infracost/infracost/pull/3590"}, {"source": "security-advisories@github.com", "url": "https://github.com/infracost/infracost/releases/tag/v0.10.45"}, {"source": "security-advisories@github.com", "url": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-522"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.10.45)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "infracost", "source": "cna", "vendor": "infracost"}, "product": "infracost", "vendor": "infracost"}], "created": "2026-08-21T19:45:03.263673+00:00", "updated": "2026-08-21T21:15:11.965014+00:00", "vendors": ["infracost", "infracost$PRODUCT$infracost"]}