Executive brief
Infracost is a cost estimation tool for infrastructure-as-code that integrates with Terraform Cloud and registry services. The tool failed to validate that network requests were being sent to the legitimate Terraform Cloud endpoint before attaching authentication tokens, potentially exposing those secrets to malicious hostnames injected into Terraform configurations. This risk is most acute when processing pull requests with untrusted code in CI/CD pipelines that have access to Terraform Cloud tokens.
Technical details
The vulnerability is an insufficient credential protection issue (CWE-522) in Infracost's Terraform Cloud/Enterprise and registry integration. Multiple code paths attached a configured secret token to HTTP requests without validating that the destination hostname matched the trusted endpoint. An attacker could craft malicious Terraform configurations with altered hostnames to redirect authenticated requests to attacker-controlled servers, disclosing the token. The attack requires the token to be present in the CI/CD run—typically only when using `pull_request_target` trigger or equivalent setups that expose secrets to untrusted pull request content. The fix, released in version 0.10.45, restricts token attachment to requests matching the configured trusted host. Organizations using the default `on: pull_request` trigger (documented recommendation) face lower risk since fork pull requests run without secrets by default.
Affected products
- Infracost Infracost < 0.10.45
Timeline
- 2026-08-07: disclosed
- 2026-08-07: patched: Fixed in v0.10.45 (PR #3590)
- 2026-09-08: advisory: GitHub Advisory Database published