EUVD-2026-68451
GHSA-5pxh-34gw-xxq6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CloudTrail event selector modification requires AWS IAM privileges (PR:L); the detection gap produces no integrity or availability impact on the monitored system.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on @hulumi/baseline (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 1.3.2.
DescriptionCVE.org
@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring.
AnalysisAI
Incomplete CloudTrail event-selector tampering detection in @hulumi/baseline before 1.3.2 (CWE-778: Insufficient Logging) creates blind spots in AWS audit trail monitoring, allowing threat actors who have already modified CloudTrail event selectors to evade detection by the library's checks. The affected npm package misses specific forms of event-selector manipulation, reducing coverage for changes to audit logging configuration - a technique commonly used to suppress evidence of adversarial cloud activity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites must both be met: first, an attacker must possess AWS IAM credentials with the cloudtrail:PutEventSelectors permission (or equivalent, such as an overly permissive AdministratorAccess role) allowing modification of CloudTrail event selectors in the target account; second, the victim environment must use @hulumi/baseline versions before 1.3.2 as a CloudTrail integrity control and must actually execute the library's checks against the account post-tampering. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 score of 8.7 with AV:N/AC:L/AT:N/PR:N/UI:N/VC:H reflects the maximum potential confidentiality impact of undetected CloudTrail tampering, but overstates the ease of exploitation: PR:N applies to the @hulumi/baseline tool itself, but the underlying attack - modifying AWS CloudTrail event selectors - requires AWS IAM credentials with cloudtrail:PutEventSelectors or equivalent permissions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: 1.3.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-778 – Insufficient Logging
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today