CVE-2026-82858

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, an insufficient data-authenticity flaw (CWE-345) that causes untrusted reconciliation input to be treated as trusted. An attacker who can feed a crafted execute plan into a drift run over the network can trigger the flaw without privileges or user interaction, consistent with the critical CVSS 4.0 score of 9.3. Because the malicious plan bypasses security checks, the attacker can perform unsafe reconciliation operations with high impact to the confidentiality, integrity, and availability of the affected system, though per the CVSS scoring the impact does not extend to other systems. Anyone running @hulumi/drift prior to 1.3.2 is affected, particularly deployments that ingest execute plans from external or untrusted sources. There is no evidence of active exploitation: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates roughly a 0.2% probability of exploitation within 30 days.

What to do: Upgrade @hulumi/drift to version 1.3.2 or later, the first version not affected per the advisory. Until upgraded, restrict execute-plan ingestion to trusted, verified sources, validate plan provenance (e.g., source allowlisting or signatures) before processing, and review recent reconciliation runs for plans that originated from untrusted inputs.