CVE-2026-82858

CRITICAL 9.8

@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.

CWE	CWE-345
Vendor	hulumi
Product	drift
Published	Aug 31, 2026

Stay Ahead of the Next One

Get instant alerts for hulumi drift

Be the first to know when new critical vulnerabilities affecting hulumi drift are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

hulumi / drift

0 < 1.3.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-2ffm-hxrq-qqmm vulncheck.com: https://www.vulncheck.com/advisories/hulumi-drift-before-1.3.2-unsafe-execute-plan-acceptance