Search
Find a vulnerability
Search criteria
4 vulnerabilities by infracost
CVE-2026-71494 (GCVE-0-2026-71494)
Vulnerability from nvd – Published: 2026-08-21 17:50 – Updated: 2026-08-21 19:23
VLAI
EPSS
VEX
Title
Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Summary
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:23 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/infracost/infracost/security/a… | x_refsource_CONFIRM |
| https://github.com/infracost/infracost/pull/3590 | x_refsource_MISC |
| https://github.com/infracost/infracost/commit/3d2… | x_refsource_MISC |
| https://github.com/infracost/infracost/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:23:15.884212Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:23:57.520Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "infracost",
"vendor": "infracost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.10.45"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:50:43.655Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h"
},
{
"name": "https://github.com/infracost/infracost/pull/3590",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/pull/3590"
},
{
"name": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f"
},
{
"name": "https://github.com/infracost/infracost/releases/tag/v0.10.45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/releases/tag/v0.10.45"
}
],
"source": {
"advisory": "GHSA-6x6c-w9w9-hv4h",
"discovery": "UNKNOWN"
},
"title": "Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71494",
"datePublished": "2026-08-21T17:50:43.655Z",
"dateReserved": "2026-08-06T19:56:23.725Z",
"dateUpdated": "2026-08-21T19:23:57.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71493 (GCVE-0-2026-71493)
Vulnerability from nvd – Published: 2026-08-21 17:52 – Updated: 2026-08-26 17:33
VLAI
EPSS
VEX
Title
Infracost: Arbitrary file read via config-template readFile symlink traversal
Summary
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 17:33 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/infracost/infracost/security/a… | x_refsource_CONFIRM |
| https://github.com/infracost/infracost/pull/3586 | x_refsource_MISC |
| https://github.com/infracost/infracost/commit/4d3… | x_refsource_MISC |
| https://github.com/infracost/infracost/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T17:33:05.338155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T17:33:14.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "infracost",
"vendor": "infracost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.10.45"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:52:29.001Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/infracost/infracost/security/advisories/GHSA-mmg6-4qmv-6pc8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/infracost/infracost/security/advisories/GHSA-mmg6-4qmv-6pc8"
},
{
"name": "https://github.com/infracost/infracost/pull/3586",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/pull/3586"
},
{
"name": "https://github.com/infracost/infracost/commit/4d39331afc0e27752d16d9d91c34583e5e8487fb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/commit/4d39331afc0e27752d16d9d91c34583e5e8487fb"
},
{
"name": "https://github.com/infracost/infracost/releases/tag/v0.10.45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/releases/tag/v0.10.45"
}
],
"source": {
"advisory": "GHSA-mmg6-4qmv-6pc8",
"discovery": "UNKNOWN"
},
"title": "Infracost: Arbitrary file read via config-template readFile symlink traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71493",
"datePublished": "2026-08-21T17:52:29.001Z",
"dateReserved": "2026-08-06T19:56:23.725Z",
"dateUpdated": "2026-08-26T17:33:14.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71493 (GCVE-0-2026-71493)
Vulnerability from cvelistv5 – Published: 2026-08-21 17:52 – Updated: 2026-08-26 17:33
VLAI
EPSS
VEX
Title
Infracost: Arbitrary file read via config-template readFile symlink traversal
Summary
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 17:33 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/infracost/infracost/security/a… | x_refsource_CONFIRM |
| https://github.com/infracost/infracost/pull/3586 | x_refsource_MISC |
| https://github.com/infracost/infracost/commit/4d3… | x_refsource_MISC |
| https://github.com/infracost/infracost/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T17:33:05.338155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T17:33:14.286Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "infracost",
"vendor": "infracost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.10.45"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an intermediate directory symlink. A repository can contain a path such as evil/file where evil points outside the checkout, causing os.ReadFile and related operations to follow the symlink and read runner-accessible files. The resulting content is rendered into generated configuration and can be surfaced through the Infracost dashboard or pull request comment, with greater impact in workflows that provide repository secrets. This issue is fixed in version 0.10.45."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:52:29.001Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/infracost/infracost/security/advisories/GHSA-mmg6-4qmv-6pc8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/infracost/infracost/security/advisories/GHSA-mmg6-4qmv-6pc8"
},
{
"name": "https://github.com/infracost/infracost/pull/3586",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/pull/3586"
},
{
"name": "https://github.com/infracost/infracost/commit/4d39331afc0e27752d16d9d91c34583e5e8487fb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/commit/4d39331afc0e27752d16d9d91c34583e5e8487fb"
},
{
"name": "https://github.com/infracost/infracost/releases/tag/v0.10.45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/releases/tag/v0.10.45"
}
],
"source": {
"advisory": "GHSA-mmg6-4qmv-6pc8",
"discovery": "UNKNOWN"
},
"title": "Infracost: Arbitrary file read via config-template readFile symlink traversal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71493",
"datePublished": "2026-08-21T17:52:29.001Z",
"dateReserved": "2026-08-06T19:56:23.725Z",
"dateUpdated": "2026-08-26T17:33:14.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71494 (GCVE-0-2026-71494)
Vulnerability from cvelistv5 – Published: 2026-08-21 17:50 – Updated: 2026-08-21 19:23
VLAI
EPSS
VEX
Title
Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname
Summary
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:23 UTC
CWE
- CWE-522 - Insufficiently Protected Credentials
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/infracost/infracost/security/a… | x_refsource_CONFIRM |
| https://github.com/infracost/infracost/pull/3590 | x_refsource_MISC |
| https://github.com/infracost/infracost/commit/3d2… | x_refsource_MISC |
| https://github.com/infracost/infracost/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:23:15.884212Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:23:57.520Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "infracost",
"vendor": "infracost",
"versions": [
{
"status": "affected",
"version": "\u003c 0.10.45"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-522",
"description": "CWE-522: Insufficiently Protected Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T17:50:43.655Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/infracost/infracost/security/advisories/GHSA-6x6c-w9w9-hv4h"
},
{
"name": "https://github.com/infracost/infracost/pull/3590",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/pull/3590"
},
{
"name": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/commit/3d24c757f5e4e60c7259f1b89ad7ceaabcfca86f"
},
{
"name": "https://github.com/infracost/infracost/releases/tag/v0.10.45",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/infracost/infracost/releases/tag/v0.10.45"
}
],
"source": {
"advisory": "GHSA-6x6c-w9w9-hv4h",
"discovery": "UNKNOWN"
},
"title": "Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71494",
"datePublished": "2026-08-21T17:50:43.655Z",
"dateReserved": "2026-08-06T19:56:23.725Z",
"dateUpdated": "2026-08-21T19:23:57.520Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}