Infracost v0.10.47: Security Release Patches Go Toolchain CVE-2026-111943

Introduction

Infracost v0.10.47 has been released as a security-only update. There are no new user-facing features or CLI flags in this release — it exists solely to patch a vulnerability in the Go toolchain that Infracost is built with. Teams running Infracost in CI pipelines to generate cloud cost estimates for Terraform plans should prioritize this upgrade, especially if Infracost binaries or container images are scanned by vulnerability tools like AWS Inspector or similar.

What Is New

According to the release notes, this version addresses CVE-2026-111943 by updating the Go compiler and standard library dependencies:

• Go toolchain bump: Infracost is now built with Go 1.26.10 (previously on an older Go version). This resolves findings flagged by vulnerability scanners such as AWS Inspector.
• x/net dependency update: golang.org/x/net was bumped alongside the Go toolchain to close out related CVE exposure (PR #3631 by @aliscott).
• Build environment update: The release build now uses Go 1.26.10 with Alpine 3.24 as the base image (PR #3634 by @liamg), which also picks up upstream Alpine security patches for the container image.

No HCL-facing behavior, CLI flags, pricing API changes, or output format changes are documented in this release. There are no deprecations or breaking changes noted.

If you maintain a Dockerfile or CI job that pulls a specific Infracost image digest, note that the underlying base image has changed from an older Alpine release to 3.24, which may shift package versions inside the container (e.g., libc, openssl) if you install anything on top of the official image.

Upgrade Steps

Infracost is typically installed as a standalone CLI binary or container image rather than referenced via a Terraform required_providers block, so there's no provider version constraint to edit. Upgrade using whichever install method your pipeline uses.

If installed via the official install script:

curl -fsSL https://raw.githubusercontent.com/infracost/infracost/master/scripts/install.sh | sh
 
infracost --version

If using Homebrew:

brew upgrade infracost

If pinning the Docker image in CI (e.g., GitHub Actions, GitLab CI):

docker pull infracost/infracost:ci-0.10
# or pin the exact tag for reproducibility
docker pull infracost/infracost:0.10.47

If using the Infracost GitHub Action, bump the version pin:

- name: Setup Infracost
  uses: infracost/actions/setup@v3
  with:
    api-key: ${{ secrets.INFRACOST_API_KEY }}
    version: 0.10.47

After upgrading the CLI, no changes to Terraform configuration or terraform init are required — Infracost operates against your existing Terraform plan files or HCL directories as before:

terraform plan -out tfplan.binary
infracost breakdown --path tfplan.binary

Verify

Confirm the binary reports the patched version and Go build:

infracost --version
# expect: Infracost v0.10.47
 
infracost diagnose

For container-based pipelines, check the image build info to confirm the Go runtime:

docker run --rm infracost/infracost:0.10.47 --version

If your organization tracks CVE remediation via a vulnerability scanner (e.g., AWS Inspector, Trivy, Grype), re-scan the updated binary or image and confirm CVE-2026-111943 no longer appears in findings.

Conclusion

v0.10.47 is a maintenance/security release with no functional changes to how Infracost estimates Terraform plan costs. The priority here is operational: update the CLI binary, container image, or CI action pin promptly to close out CVE-2026-111943, then re-run vulnerability scans to confirm remediation. No Terraform HCL or workflow changes are needed on the user side.