CVE-2026-71494

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...

CVE-2026-71493

Infracost versions prior to 0.10.45 are vulnerable to an arbitrary file read via symlink traversal in the config template parser (internal/config/template/parser.go). The readFile, pathExists, isDir, and matchPaths template functions rely on a lexical filepath.Rel check and a leaf-only os.Lstat c...

EUVD-2026-64035

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel check and a leaf-only os.Lstat check that do not resolve an...

CVE-2026-71494 Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...

CVE-2026-71494

Infracost prior to 0.10.45 contains a token disclosure vulnerability in internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths. The root cause is that a configured Terraform Cloud or registry token can be attached to a destination h...

EUVD-2026-64019

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remotevariablesloader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination...

PT-2026-79415

Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote variables loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destinati...