CVE-2026-71494: Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, internal/hcl/re

Infracost, a tool that calculates cloud costs for engineering teams and AI systems, had a vulnerability before version 0.10.45 where it could accidentally send secret authentication tokens (credentials that prove who you are to Terraform Cloud services) to the wrong server. If an attacker controlled the Terraform configuration files being scanned, they could trick Infracost into sending the token to their own server instead of the legitimate one, allowing them to steal it. This happens in CI/CD pipelines (automated build and deployment systems) when a token is provided during scanning.