CVE-2026-71494

CVE-2026-71494 in Infracost allows token exfiltration through a missing hostname validation when processing untrusted Terraform input. The vulnerability lives in internal/hcl/remote_variables_loader.go, where the tool attaches Terraform Cloud or registry tokens to outbound HTTP requests targeting hosts derived from the Terraform configuration being analyzed. The implicit assumption: the Terraform input tells you where to connect, and that's a trusted source. The problem: modern development workflows routinely process attacker-controlled Terraform as normal operation — AI agents analyzing pull requests, CI pipelines scanning third-party modules, workflows that ingest community templates. The fix in version 0.10.45 adds hostname confirmation against the configured trusted endpoint. This is the correct immediate remediation — it's basic token-safety hygiene that should have existed from the start. However, this vulnerability is not an isolated incident. It belongs to a recurring pattern across infrastructure tooling: Terragrunt (CVE-2023-32782), terraform-provider (CVE-2024-42451), terraform-cdk (CVE-2025-43378) — same flaw, same mental separation between

Reviewed through automated stages and approved by a human before publication.