CVE-2026-82863

Versions of the @hulumi/baseline package before 1.3.2 fail to fully detect changes made to AWS CloudTrail event selectors, leaving a coverage gap in audit-logging configuration monitoring (CWE-778). The flaw is triggered when a party with permissions in the monitored AWS account modifies CloudTrail event selectors — for example narrowing which management or data events are recorded — while baseline is relying on CloudTrail events to flag such changes. Because these tampering events are not completely detected, an attacker can reduce or disable portions of an account's audit trail and operate with a reduced chance of being observed by downstream audit monitoring. Any deployment running @hulumi/baseline prior to 1.3.2 to watch AWS CloudTrail logging configuration is affected. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS (0.1%, 4th percentile) indicates low near-term exploitation likelihood, with no known exploitation in the wild.

What to do: Upgrade @hulumi/baseline to version 1.3.2 or later to restore full CloudTrail selector tampering detection. In the interim, independently monitor CloudTrail event selector changes via CloudTrail management events (PutEventSelectors, UpdateTrail, StopLogging), EventBridge alerts, or AWS Config rules, and review recent event selector changes in your accounts for signs of tampering.