CVE-2026-71494: Infracost: Terraform Cloud and registry token disclosure via unvalidated hostname

Sensitive information exposure in the Infracost Terraform Cloud/Enterprise integration. Several code paths attached a configured secret token to a request whose host was taken straight from the scanned Terraform, with no check that the host was the trusted endpoint.

The condition that matters is whether a Terraform Cloud/Enterprise (or registry) token is present in the run: if one is, the injected hostname can disclose it. Impact therefore depends on the trigger. Under on: pull_request (the only configuration in Infracost’s documentation) fork pull requests run without secrets, so no token is present. It only reaches token disclosure under pull_request_target, a same-repository pull request, or another CI setup that provides the token alongside untrusted Terraform, and exploiting an untrusted fork pull request also typically needs a maintainer to approve the workflow run. The patch scopes the token to the trusted host regardless of trigger.