EUVD-2026-64019Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector but AC:H because exploitation requires the specific pull_request_target CI pattern with secrets; PR:N as no attacker account privileges are needed; UI:R because CI scan must be triggered; C:H for full token disclosure; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/remote_variables_loader.go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0.10.45.
AnalysisAI
Token exfiltration in Infracost prior to 0.10.45 allows an attacker who controls scanned Terraform source to redirect a configured Terraform Cloud or registry credential to an arbitrary attacker-controlled host. The vulnerable code path in internal/hcl/remote_variables_loader.go derived the destination hostname from untrusted Terraform cloud/backend block attributes without validating it against the operator-configured trusted host. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions must be met: (1) Infracost must be configured with a Terraform Cloud or Enterprise API token in the CI environment; (2) the CI workflow must expose that token to a scan of code the attacker can influence - the vendor explicitly identifies pull_request_target workflows and same-repository pull requests as the vulnerable patterns, and confirms that standard fork pull_request workflows without secrets are not affected; (3) the attacker must be able to place a Terraform cloud or backend block with a controlled hostname attribute in the code being scanned. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.9 accurately reflects a medium-severity credential disclosure issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Infracost to version 0.10.45 or later; this is the vendor-confirmed fix and the only complete remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today