THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-6x6c-w9w9-hv4h (medium) — Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

[GHSA] GHSA-6x6c-w9w9-hv4h (medium) — Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

medgithub_advisoriesPublished 2026-09-08

GHSA-6x6c-w9w9-hv4h Severity: medium CVE: CVE-2026-71494

Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

### Impact

Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was th

Indicators of compromise

CVE-2026-71494cve

Original source: https://github.com/advisories/GHSA-6x6c-w9w9-hv4h