Critical severity9.8NVD Advisory· Published Aug 31, 2026· Updated Aug 31, 2026

CVE-2026-82858

Description

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Hulumi/hulumillm-fuzzy
Range: <1.3.2

Patches

Vulnerability mechanics

References

github.com/kerberosmansour/hulumi/security/advisories/GHSA-2ffm-hxrq-qqmmnvd
www.vulncheck.com/advisories/hulumi-drift-before-1.3.2-unsafe-execute-plan-acceptancenvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000