Vulnerability in github.com/infracost/infracost (CVE-2026-71494)
Summary
Vulnerability in github.com/infracost/infracost (CVE-2026-71494). Risk of unauthorized operations or information disclosure. Exploitable via pull_request_target. Mitigation: upgrade to 0.10.45 or later.
Original description
The description as published by the source.
Impact
Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint.
The condition that matters is whether a Terraform Cloud/Enterprise (or registry) token is present in the run: if one is, the injected hostname can disclose it. Impact therefore depends on the trigger. Under on: pull_request (the only configuration in Infracost's documentation) fork pull requests run without secrets, so no token is present. It only reaches token disclosure under pull_request_target, a same-repository pull request, or another CI setup that provides the token alongside untrusted Terraform, and exploiting an untrusted fork pull request also typically needs a maintainer to approve the workflow run. The patch scopes the token to the trusted host regardless of trigger.
Patches
Fixed in v0.10.45 (#3590) by attaching a token only when the destination host matches the configured trusted host; otherwise Infracost refuses to send it and skips remote variable loading
- Installed via the official script, a package manager, or the
latestDocker tag: upgrade tov0.10.45(or later) to receive the fix. - Pinned to a specific version or image digest: bump to
v0.10.45.
Workarounds
No full fix without upgrading. To limit expo…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-71494 has been found in github.com/infracost/infracost.
Attackers can target a specific entry point like pull_request_target over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade github.com/infracost/infracost to 0.10.45 or later.
If unsure, ask your IT team or search "github.com/infracost/infracost CVE-2026-71494" on the vendor's site.
CVE-2026-71494 (github.com/infracost/infracost) — CWE-522
Attack surface: pull_request_target / latest / organization / workspace
Patched: 0.10.45 — apply immediately
Workaround: No full fix without upgrading.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-522) exists in github.com/infracost/infracost. Attackers reach the vulnerable code path via pull_request_target.
Check the vendor advisory for the affected versions of github.com/infracost/infracost. Attack surface: pull_request_target / latest / organization / workspace.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 0.10.45.
Workaround: No full fix without upgrading.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'github.com/infracost/infracost' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'github.com/infracost/infracost' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
github.com/infracost/infracostを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
No full fix without upgrading.パッチが適用されるまでの応急処置として、No full fix without upgrading. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade github.com/infracost/infracost to 0.10.45ステージング環境で 0.10.45 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。