EUVD-2026-48726
GHSA-32g3-35g9-wc9g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker obtains cloud console credentials
-
DeliveryWait for or induce transient drift-adapter error
-
ExploitClassifier caches None/none verdict for 6 hours
-
ExecutionPerform console-break-glass mutation in window
-
PersistDownstream alerting gates on stale verdict
-
ImpactMutation remains undetected until cache expires
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling procedures
|
| Exploitation Conditions | This is a detective-control fail-open bug, not a remotely triggerable vulnerability: the prerequisite is that the victim runs @hulumi/drift < 1.4.0 in CI/cron with the default 6-hour verdict cache enabled and downstream incident workflows that gate on its verdict. The cached-all-clear case (1) requires at least one adapter - most plausibly the Pulumi Automation API probe - to return an error rather than |
| Impact | No CVSS vector or EPSS score is published for this CVE, and it is not listed in CISA KEV - the vendor self-classifies severity as Medium. The realistic risk profile is integrity-of-signal rather than direct compromise: the vulnerability silently degrades a detective control, so its true blast radius depends entirely on what downstream automation gates on the verdict (paging, auto-remediation, audit attestations). For teams using @hulumi/drift to detect out-of-band AWS console changes, a single transient adapter error caches a six-hour 'all clear' window during which an active console-break-glass mutation would be hidden - a high-impact failure mode for incident-response tooling even though there is no remote attacker primitive. The 'Privilege Escalation' tag attached to the CVE is misleading: this is a fail-open detection bug, not an authorization bypass, and should not be triaged as a remote PE vulnerability. No public exploit identified at time of analysis. |
| Exploit ScenarioDerived | An attacker with valid AWS console access (e.g. a stolen break-glass credential) waits for or induces a transient failure in one of the drift adapters - for example a brief Pulumi Automation API timeout during a scheduled CI run - and then performs console mutations within the 6-hour cached 'None / none' window, knowing the detective control will not surface the change to downstream alerting. No public exploit identified at time of analysis, and exploitation requires the attacker to already possess the underlying cloud privileges they are trying to use undetected. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Drift-detection logic flaw in the @hulumi/drift npm package (versions < 1.4.0) causes the verdict classifier to conflate adapter failure with a clean result, producing cached false-negative 'None / none' verdicts for up to six hours and false-positive incident-severity 'Mixed / high' or 'ConsoleBreakGlass / high' verdicts based on probe liveness rather than CloudTrail evidence. Consumers running drift detection in CI or cron pipelines could silently miss real console-break-glass mutations or be paged on routine provider-version churn. No public exploit identified at time of analysis; the issue is a CWE-755 improper-exception-handling defect rather than a remote attack primitive.
RemediationAI
Vendor-released patch: upgrade @hulumi/drift to 1.4.0, which is a classifier-only change that keeps the TLA+-verified 6-row verdict matrix byte-identical while making adapter failures fail closed to 'Unknown / low', refusing to write degraded verdicts into the cache, and requiring real CloudTrail event evidence (not probe liveness) before promoting to Mixed or ConsoleBreakGlass. See the advisory at https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g and the fix in https://github.com/kerberosmansour/hulumi/pull/178. As a partial workaround for the cached-all-clear case only, callers can set options.minConfidence: "medium" on the classifier call so the degraded None / none verdict no longer meets the cache threshold; the trade-off is that legitimate low-confidence clean verdicts will also stop being cached, increasing adapter call volume, and there is no workaround for the false-positive Mixed/ConsoleBreakGlass promotion case.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
@hulumi/drift orchestrates four independent adapters (Pulumi-state diff, provider-version comparison, CloudTrail event probe, and one other) whose results are merged by a central classifier into a six-row verdict matrix (e.g. None/none, Mixed/high, ConsoleBreakGlass/high). The bug lies in the classifier reading only each adapter response's detected: true|false field while ignoring an associated success/error indicator - the canonical CWE-755 'Improper Handling of Exceptional Conditions' pattern. As a result, an adapter that errors out (a thrown exception or transient network failure against the Pulumi Automation API) is treated the same as an adapter that ran successfully and saw no drift, and the resulting degraded verdict is then written into the 6-hour result cache. Identified by the CPE pkg:npm/@hulumi_drift.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
Primary rating from Vendor (https://github.com/kerberosmansour/hulumi) · only source for this CVE.
CVSS VectorVendor: https://github.com/kerberosmansour/hulumi
Lifecycle Timeline
1DescriptionCVE.org
Affected: @hulumi/drift < 1.4.0 - Fixed in: 1.4.0 - Severity: Medium - CWE-755 (Improper Handling of Exceptional Conditions)
Summary
@hulumi/drift runs four adapters that each ask a different question about whether a resource has drifted (Pulumi-state diff, provider-version change, CloudTrail event, etc.). A classifier combines the adapters' answers into a verdict like None / none, ConsoleBreakGlass / high, or Mixed / high, and caches the verdict for 6 hours by default.
Two related bugs from one root cause - the classifier only read each adapter's detected: true/false field and ignored whether the adapter itself succeeded:
- Cached "all clear" on adapter failure. When an adapter failed (e.g. transient network error from the Automation API), the classifier read
detected: false, concluded "no drift", and cached the verdict asNone / nonefor 6 hours. A single transient failure could mask real console-break-glass mutations for the rest of the window. - Mixed verdicts without real evidence. The
Mixed / highandConsoleBreakGlass / highverdicts (incident severity) could fire on the "the CloudTrail probe round-tripped successfully" signal rather than actual evidence that anything had been changed via the console. Normal provider-API churn could end up falsely escalated to incident severity.
Impact
Consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" - masking real attacks for up to six hours - or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it.
Patches
Upgrade to @hulumi/drift@1.4.0. Classifier-only fix (the TLA+-verified 6-row verdict matrix is byte-identical):
- adapter failures now fail closed to
Unknown / low, and degraded verdicts are not written to the cache; - the
Mixed/ConsoleBreakGlasspromotion now requires real CloudTrail event evidence rather than probe liveness.
Workarounds
Setting options.minConfidence: "medium" on the classifier call prevents the degraded None / none from being cached (it doesn't meet the threshold), partially mitigating case (1). No workaround for case (2).
Resources
- PR #178 (Cluster D); regression tests in
packages/drift/tests/classifier-fail-closed.test.ts.
Executive ViewAI
The @hulumi/drift npm package (versions prior to 1.4.0) contains a logic flaw that causes drift detection systems to produce cached false-negative verdicts for up to six hours, risking undetected console-break-glass mutations-a critical concern for compliance and incident response teams. Organizations using drift detection in CI/cron pipelines may simultaneously face alert fatigue from false-positive severity classifications, degrading the signal-to-noise ratio and masking genuine security events.
Apply vendor patch. Upgrade @hulumi/drift to version 1.4.0 or later. Prior to patching, manually correlate drift detection verdicts against CloudTrail logs to verify true positives and rule out false negatives.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB