CVE-2026-82858: @hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@hulumi/driftto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using @hulumi/drift versions earlier than 1.3.2 are affected. The issue concerns workflows that accept externally supplied execute plans.
What does an attacker need to exploit this issue?
An attacker needs to be able to supply an execute plan to a vulnerable instance. No authentication, user interaction, or special attack conditions are indicated by the provided severity vector.
What is the immediate mitigation if upgrading is not possible?
Do not accept execute plans from untrusted external sources. Restrict plan submission to trusted, controlled inputs until the package can be updated to 1.3.2 or later.