CVE-2026-82858

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

CVE-2026-82858 @hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

CVE-2026-82858

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, causing untrusted reconciliation input to be treated as trusted. An attacker can supply malicious execute plans that bypass security checks and perform unsafe reconciliation oper...

EUVD-2026-68446

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

CVE-2026-82858 @hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

CVE-2026-82858 @hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

CVE-2026-82858: Insufficient Verification of Data Authenticity

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation...

CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six...

Improper Handling of Exceptional Conditions

Overview @hulumi/drift is a Local-first drift classifier and live posture validator — distinguishes provider-API churn from console break-glass from genuine IaC drift, then renders read-only live posture findings as JSON, Markdown, and SARIF. Verdict logic mirrors HulumiDrift.tla Ha Affected...

PT-2026-45224

Impact: @hulumi/drift versions before 1.3.2 could accept externally supplied execute plans without sufficient provenance checks, allowing unsafe reconciliation input to be treated as trusted. Patched in 1.3.2: execute-plan handling now validates provenance and rejects untrusted plans, with...

PT-2026-83735

Name of the Vulnerable Software and Affected Versions @hulumi/drift versions prior to 1.3.2 Description Insufficient provenance validation allows the software to accept externally supplied execute plans, causing untrusted reconciliation input to be treated as trusted. This allows attackers to...