If you learned from my posts, inspired, or encouraged to grow in the cybersecurity and digital forensics, I would really appreciate your vote and support - Husam Shbib!
MyCyberNews

Search

Find merged stories by title or summary.

Vulnerabilities & Patches
Emerging1 src

CVE-2026-71494 - Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

CVE ID : CVE-2026-71494 Published : Aug. 21, 2026, 6:16 p. m. • 53 minutes ago Description : Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0. 10. 45, internal/hcl/remote_variables_loader. go and related Terraform Cloud, remote-plan, and Terragrunt registry request paths can attach a configured Terraform Cloud or registry token to a destination hostname derived from untrusted Terraform input without confirming that it is the configured trusted host. When a CI run provides a token while scanning attacker-controlled Terraform, including pull_request_target or a same-repository pull request, an attacker can direct the request to an attacker-controlled host and disclose the token. Standard fork pull_request workflows without secrets are not exposed. This issue is fixed in version 0. 10. 45. Severity: 5.9 • MEDIUM

·CVEFeed
Read →

You've reached the end of current stories for this search.