Remote Code Execution in @hulumi/drift

Executive Summary

CVE-2026-82858 affects the @hulumi/drift package versions before 1.3.2. It allows externally supplied execute plans to be accepted without proper validation of their origin or authenticity. Attackers can exploit this to submit malicious plans that bypass security checks and perform unsafe reconciliation operations.

Useful 0 Not Useful 0

Detection Guidance

Check installed versions of @hulumi/drift using npm list @hulumi/drift. If the version is below 1.3.2, the system is vulnerable. Inspect logs for unexpected execute plan submissions or reconciliation operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to execute unauthorized or malicious operations through the drift package, potentially leading to data breaches, system compromise, or unauthorized changes. The high CVSS scores (9.3 and 9.8) indicate significant risk of confidentiality, integrity, and availability impacts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modifications, violating GDPR's integrity and confidentiality principles or HIPAA's security requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to insufficient data authenticity verification.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade @hulumi/drift to version 1.3.2 or later immediately. Ensure provenance validation is enabled in configuration. Monitor for suspicious reconciliation activities.

Useful 0 Not Useful 0