CVE-2026-82858: @hulumi/drift Auth Bypass Vulnerability

CVE-2026-82858 Overview

CVE-2026-82858 affects the @hulumi/drift npm package in versions before 1.3.2. The package accepts externally supplied execute plans without validating their provenance. Attackers can submit malicious reconciliation input that the library treats as trusted. This bypasses security checks and allows unsafe reconciliation operations against target infrastructure. The weakness is classified under CWE-345: Insufficient Verification of Data Authenticity.

Critical Impact
Unauthenticated network attackers can inject forged execute plans, compromising confidentiality, integrity, and availability of resources managed by @hulumi/drift.

Affected Products

@hulumi/drift npm package, all versions prior to 1.3.2
Applications embedding @hulumi/drift for infrastructure reconciliation workflows
Automated pipelines that consume externally supplied execute plans through this library

Discovery Timeline

2026-08-31 - CVE-2026-82858 published to the National Vulnerability Database
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82858

Vulnerability Analysis

The @hulumi/drift library orchestrates reconciliation operations by consuming execute plans that describe the changes to apply against a target system. In vulnerable releases, the library accepts these plans from external callers without verifying their origin or integrity. Any input that matches the expected plan structure is executed as if it were produced by a trusted planner.

The missing provenance check turns reconciliation into an arbitrary-action primitive. An attacker who can reach the interface accepting plans can drive the reconciler to perform operations that the surrounding application never authorized. Because reconciliation typically runs with elevated privileges over managed resources, the impact spans confidentiality, integrity, and availability.

Root Cause

The root cause is insufficient authenticity verification of inbound execute plans [CWE-345]. The library trusts the plan object rather than binding it to a signed planning step, a validated policy set, or an authenticated source. Downstream security checks are effectively bypassed because they operate on plan data that is already assumed to be legitimate.

Attack Vector

Exploitation requires no authentication, no user interaction, and low attack complexity over the network. An attacker crafts a malicious execute plan that encodes attacker-chosen reconciliation actions. Delivering that plan to the vulnerable endpoint or code path causes @hulumi/drift to execute the actions against managed resources without further validation.

Refer to the GitHub Security Advisory GHSA-2ffm-hxrq-qqmm and the VulnCheck Advisory for Hulumi Drift for additional technical context.

Detection Methods for CVE-2026-82858

Indicators of Compromise

Reconciliation actions executed by @hulumi/drift that do not correspond to any prior planning step recorded in application logs.
Execute plans arriving from network sources or user-controlled inputs rather than from the internal planner.
Unexpected state changes on managed resources shortly after external requests to services embedding @hulumi/drift.

Detection Strategies

Inventory application dependencies for @hulumi/drift at versions below 1.3.2 using software composition analysis.
Correlate reconciliation execution logs with planner output to identify plans lacking a matching trusted origin.
Alert on reconciliation operations whose plan hashes or identifiers were never emitted by the internal planning subsystem.

Monitoring Recommendations

Enable verbose logging around plan ingestion and execution paths, capturing plan source, caller identity, and plan digest.
Monitor outbound provider API calls initiated by reconcilers for volume spikes or unusual resource targets.
Forward reconciliation and dependency inventory telemetry into a centralized analytics pipeline for retrospective hunting.

How to Mitigate CVE-2026-82858

Immediate Actions Required

Upgrade @hulumi/drift to version 1.3.2 or later across all services and build pipelines.
Audit application entry points that forward external input into @hulumi/drift and restrict them to trusted callers.
Review historical reconciliation logs for plans that lack a corresponding trusted planning event.

Patch Information

The maintainers addressed the issue in @hulumi/drift1.3.2 by enforcing provenance validation on execute plans. Consult the GitHub Security Advisory GHSA-2ffm-hxrq-qqmm for the authoritative fix details and upgrade guidance.

Workarounds

Place vulnerable services behind authenticated, network-restricted interfaces that reject unsolicited plan submissions.
Require execute plans to be produced only by the internal planner and drop any plan that arrives through an external channel.
Wrap @hulumi/drift calls with an application-level check that verifies a signature or trusted identifier on each plan before execution.

bash

# Upgrade to the fixed release
npm install @hulumi/drift@^1.3.2

# Verify the resolved version in the dependency tree
npm ls @hulumi/drift