CVE-2026-71494
Gravedad CVSS v4.0:
MEDIA
Tipo:
CWE-522
Credenciales insuficientemente protegidas
Fecha de publicación:
21/08/2026
Última modificación:
21/08/2026
Descripción
*** Pendiente de traducción *** Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.
Impacto
Puntuación base 4.0
5.90
Gravedad 4.0
MEDIA