Description

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T09:17:06.067Z",
  "pubdate": "2026-08-31T09:17:06.067Z",
  "executiveSummary": "The @hulumi/drift package is susceptible to a critical vulnerability involving the improper validation of externally supplied execution plans.\nThe vulnerability is classified as an improper input validation flaw, where the system fails to verify the authenticity or source of reconciliation instructions.\nThis allows an untrusted actor to inject malicious execution plans, which the application subsequently processes as trusted data.\nThe impact includes the potential for unauthorized and unsafe reconciliation operations, which could compromise the integrity of the managed infrastructure.\nAffected systems include @hulumi/drift versions prior to 1.3.2.\nThe risk implication is significant, as the vulnerability enables attackers to bypass existing security controls and manipulate state reconciliation workflows without requiring legitimate administrative authorization.\nExploitation requires the attacker to have the ability to supply input to the reconciliation engine, effectively positioning them to influence the drift detection and remediation process.",
  "technicalDetails": "The vulnerability exists within the reconciliation engine of @hulumi/drift, specifically concerning how it handles incoming execute plans.\nThe root cause is a lack of cryptographic signing or provenance validation for execution plans, meaning the application treats any plan payload as legitimate once received, regardless of its origin.\nThe vulnerable component is the processing logic responsible for accepting and executing external reconciliation tasks. When the application receives an input intended to drive a drift remediation, it fails to verify that the instruction set was generated by a trusted source or adheres to a strict schema of known-safe operations.\nAn attacker can exploit this by crafting a malicious execution plan that defines unauthorized or destructive operations. Because the system does not enforce provenance checks, these malicious plans are ingested by the reconciliation controller.\nThe attack flow proceeds as follows: First, the attacker identifies an endpoint or interface that consumes execution plans. Second, the attacker generates a custom execution plan that specifies unintended changes or state modifications. Third, the attacker transmits this plan to the target instance of @hulumi/drift. Fourth, the application processes the untrusted input and executes the malicious operations as if they were validated tasks.\nBy bypassing the security checks intended to gate reconciliation operations, an attacker can manipulate infrastructure state, perform unauthorized modifications, or force the system into a compromised state. This represents an escalation of privilege from the perspective of the application, as the attacker essentially hijacks the workflow engine.\nThe exploitation does not necessarily require authentication to the underlying operating system or infrastructure if the reconciliation endpoint is exposed to the attacker. Post-exploitation impact is severe, as the attacker can effectively control the drift remediation process to perform arbitrary operations that the underlying service account possesses permissions for.\nThis vulnerability persists in all versions of @hulumi/drift prior to 1.3.2."
}