Cpe:2.3:a:hulumi:drift:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ahulumidrift/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 31 Aug 2026 11:16:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper Provenance Validation in @hulumi/drifthttps://feed.craftedsignal.io/briefs/2026-08-drift-vulnerability/Mon, 31 Aug 2026 11:16:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-drift-vulnerability/The @hulumi/drift package versions prior to 1.3.2 are susceptible to malicious reconciliation plan injection due to insufficient validation of externally supplied execute plans.The @hulumi/drift package, specifically in versions prior to 1.3.2, contains a critical security vulnerability (CVE-2026-82858) stemming from improper validation of execute plans. The application accepts reconciliation plans from external sources without verifying their origin or integrity. This flaw enables an attacker to supply a crafted, malicious execute plan that is treated as trusted by the system. If exploited, an attacker can bypass security controls intended to govern reconciliation operations, leading to the execution of unauthorized or unsafe system modifications. Given the nature of drift management tools, this could result in significant state manipulation or unauthorized infrastructure changes. Defenders should prioritize updating to version 1.3.2 or later to ensure that execute plans are subjected to proper validation.

Impact

Successful exploitation of this vulnerability allows unauthorized actors to bypass security checks and force the execution of arbitrary or malicious reconciliation operations. This could lead to unauthorized state changes, potential data loss, or system instability within the managed infrastructure. The scope of impact is limited to environments utilizing the @hulumi/drift package for reconciliation, with the severity being classified as critical (CVSS 9.8).

Recommendation

  • Upgrade @hulumi/drift to version 1.3.2 or later immediately to address the lack of provenance validation for execute plans.
  • Audit logs for reconciliation operations to identify anomalies in the execution plan source or content occurring prior to the patch.
  • Restrict access to systems capable of submitting external reconciliation plans to only verified and trusted service identities.
]]>mediumadvisory