CVE-2026-82863: hulumi baseline CloudTrail Detection Flaw

CVE-2026-82863 Overview

CVE-2026-82863 affects the @hulumi/baseline package in versions prior to 1.3.2. The package fails to fully detect AWS CloudTrail event selector tampering, creating a gap in audit logging configuration change coverage. Attackers who can modify CloudTrail event selectors may evade audit trail monitoring without triggering complete detection alerts. The weakness is categorized as insufficient logging [CWE-778].

The issue is remotely exploitable and requires no authentication or user interaction against the monitoring component itself, based on its published CVSS 4.0 vector. Confidentiality impact is rated high because incomplete audit coverage can conceal further malicious activity within an AWS environment.

Critical Impact
Incomplete detection of CloudTrail selector tampering allows adversaries to silently reduce audit trail visibility, undermining downstream investigations and compliance controls.

Affected Products

@hulumi/baseline versions prior to 1.3.2
AWS CloudTrail monitoring pipelines that rely on @hulumi/baseline for selector change detection
Environments using Hulumi baseline controls for AWS logging assurance

Discovery Timeline

2026-08-31 - CVE-2026-82863 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82863

Vulnerability Analysis

The @hulumi/baseline package provides baseline security controls that monitor AWS configuration changes, including CloudTrail event selector modifications. CloudTrail event selectors define which management and data events are recorded in a given trail. Modifying, removing, or narrowing these selectors reduces what CloudTrail records.

In versions before 1.3.2, the package does not fully evaluate the complete set of selector change events emitted by CloudTrail. Certain selector tampering actions are not surfaced as configuration change findings. As a result, downstream detection pipelines relying on @hulumi/baseline receive incomplete signals about audit configuration drift.

The practical effect is a monitoring blind spot rather than a direct compromise of AWS infrastructure. Adversaries who already hold sufficient AWS privileges can shape CloudTrail coverage while remaining below the detection threshold implemented by the baseline.

Root Cause

The root cause is insufficient logging and detection logic [CWE-778] inside the CloudTrail selector monitoring routine. The package's event evaluation does not cover every relevant CloudTrail API action or every field within PutEventSelectors and related requests. Partial coverage leaves gaps that attackers can target when tampering with selectors.

Attack Vector

An attacker with the AWS permissions required to modify CloudTrail configuration invokes selector tampering API calls, such as PutEventSelectors or PutInsightSelectors, using values or fields that the vulnerable detection logic does not fully inspect. CloudTrail continues to record the API call, but the @hulumi/baseline control does not raise a complete configuration change finding. The attacker then relies on the reduced selector coverage to hide subsequent activity from CloudTrail recording.

No verified exploit code is publicly available for this issue. Refer to the GitHub Security Advisory GHSA-gfp8-mp24-5vxg and the VulnCheck Advisory on Hulumi for advisory-level technical details.

Detection Methods for CVE-2026-82863

Indicators of Compromise

CloudTrail PutEventSelectors or PutInsightSelectors API calls that reduce, remove, or narrow event selectors on production trails.
CloudTrail management events showing UpdateTrail, StopLogging, or DeleteTrail actions without a corresponding change ticket or approval.
Gaps in expected CloudTrail data events for S3 buckets, Lambda functions, or other resources previously covered by selectors.
Absence of @hulumi/baseline configuration-change findings during periods when CloudTrail selector API activity is observed in raw logs.

Detection Strategies

Correlate raw CloudTrail API activity against @hulumi/baseline findings and alert on selector change events that lack a matching baseline finding.
Build direct detections on eventName values PutEventSelectors, PutInsightSelectors, UpdateTrail, StopLogging, and DeleteTrail regardless of the baseline output.
Baseline the expected selector configuration for each trail and alert on any diff, including changes to DataResources, ReadWriteType, or IncludeManagementEvents.

Monitoring Recommendations

Ingest CloudTrail management and data events into a centralized log platform and retain them for the period required by policy.
Alert on any identity that calls CloudTrail configuration APIs outside of approved automation roles.
Continuously validate that all expected trails remain enabled, multi-region, and cover the intended resource scope.

How to Mitigate CVE-2026-82863

Immediate Actions Required

Upgrade @hulumi/baseline to version 1.3.2 or later across all environments that consume the package.
Inventory current CloudTrail event selectors on every trail and compare them to the documented, approved configuration.
Restrict IAM permissions for cloudtrail:PutEventSelectors, cloudtrail:PutInsightSelectors, cloudtrail:UpdateTrail, cloudtrail:StopLogging, and cloudtrail:DeleteTrail to a minimal set of automation and administrative principals.
Enable AWS Config managed rules such as cloudtrail-enabled and cloud-trail-log-file-validation-enabled to independently verify trail state.

Patch Information

Upgrade to @hulumi/baseline version 1.3.2 or later. This release adds full detection coverage for CloudTrail selector tampering events. Consult the GitHub Security Advisory GHSA-gfp8-mp24-5vxg for release notes and fix details.

Workarounds

Implement compensating detections directly on raw CloudTrail events for PutEventSelectors, PutInsightSelectors, UpdateTrail, StopLogging, and DeleteTrail until the package is upgraded.
Use AWS Organizations service control policies (SCPs) to deny CloudTrail configuration changes for all principals except a dedicated logging administration role.
Enable CloudTrail log file integrity validation and forward logs to a separate, write-restricted S3 bucket in a logging account.