EUVD-2026-68446
GHSA-wpxp-22v5-r9cx
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated acceptance of forged execute plans (CWE-345) with no interaction gives AV:N/AC:L/PR:N/UI:N; trusted malicious reconciliation impacts C/I/A high, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.
AnalysisAI
Security-check bypass in @hulumi/drift before 1.3.2 allows remote attackers to submit forged execute plans that the orphan reconciler treats as trusted, enabling unsafe reconciliation operations across all three impact dimensions. The flaw stems from missing provenance validation on externally supplied plans (CWE-345), and the CVSS 4.0 base score is 9.3 (Critical) with a network, no-privilege, no-interaction vector. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target run @hulumi/drift before 1.3.2 AND that its orphan reconciler be configured/deployed such that it ingests execute plans originating from outside the trust boundary - the vulnerable behavior is acceptance of externally supplied execute plans without provenance validation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent toward high priority: the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes remote, unauthenticated, low-complexity exploitation with high confidentiality, integrity, and availability impact on the vulnerable system, yielding a 9.3 Critical score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @hulumi/drift to 1.3.2 or later (Vendor-released patch: 1.3.2), where execute-plan handling now validates provenance and rejects untrusted plans with regression coverage; update the dependency in package.json/lockfiles and redeploy affected services. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudfla
Privilege escalation in the @hulumi/policies npm package before 1.3.2 lets attackers bypass the administrator-policy gua
IAM boundary bypass in hulumi versions before v1.3.2 stems from a deployment Service Control Policy (SCP) template that
Privilege escalation in hulumi before v1.3.2 lets an actor holding the documented IAM principal abuse the weekly integra
Security-guardrail bypass in the @hulumi/policies npm library (versions before 1.3.2) allows dangerous AWS IAM configura
Policy evaluation bypass in @hulumi/policies before 1.3.2 permits unauthenticated remote attackers to submit forged Secu
Incomplete CloudTrail event-selector tampering detection in @hulumi/baseline before 1.3.2 (CWE-778: Insufficient Logging
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today