{"id":"CVE-2026-48036","aliases":["EUVD-2026-48726","GHSA-32g3-35g9-wc9g"],"status":"published","title":"Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00511,"percentile":0.43895,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-755"],"published":"2026-06-10T13:38:50Z","modified":"2026-10-28T02:31:10Z","fixes":[{"ecosystem":"npm","package":"@hulumi/drift","fixed_in":["1.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@hulumi/drift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@hulumi/drift","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]}],"products":[{"vendor":"kerberosmansour","product":"hulumi"}],"references":[{"url":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/kerberosmansour/hulumi/pull/178","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-32g3-35g9-wc9g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48036.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48036","tags":["advisory"]},{"url":"https://github.com/kerberosmansour/hulumi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48036","title":"Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T18:44:05.631Z","modified":"2026-07-25T00:58:23.97Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-48726","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T18:44:05Z","modified":"2026-07-25T00:58:23Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"high"}],"updated_at":"2026-11-02T18:19:38.612768Z"}],"ghsa":[{"id":"GHSA-32g3-35g9-wc9g","title":"@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts","description":"**Affected:** `@hulumi/drift` `\u003c 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-755 (Improper Handling of Exceptional Conditions)**\n\n#### Summary\n\n`@hulumi/drift` runs four adapters that each ask a different question about whether a resource has drifted (Pulumi-state diff, provider-version change, CloudTrail event, etc.). A classifier combines the adapters' answers into a verdict like `None / none`, `ConsoleBreakGlass / high`, or `Mixed / high`, and caches the verdict for 6 hours by default.\n\nTwo related bugs from one root cause — the classifier only read each adapter's `detected: true/false` field and ignored whether the adapter itself succeeded:\n\n1. **Cached \"all clear\" on adapter failure.** When an adapter failed (e.g. transient network error from the Automation API), the classifier read `detected: false`, concluded \"no drift\", and cached the verdict as `None / none` for 6 hours. A single transient failure could mask real console-break-glass mutations for the rest of the window.\n2. **Mixed verdicts without real evidence.** The `Mixed / high` and `ConsoleBreakGlass / high` verdicts (incident severity) could fire on the \"the CloudTrail probe round-tripped successfully\" signal rather than actual evidence that anything had been changed via the console. Normal provider-API churn could end up falsely escalated to incident severity.\n\n#### Impact\n\nConsumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it.\n\n#### Patches\n\nUpgrade to `@hulumi/drift@1.4.0`. Classifier-only fix (the TLA+-verified 6-row verdict matrix is byte-identical):\n\n- adapter failures now fail closed to `Unknown / low`, and degraded verdicts are not written to the cache;\n- the `Mixed` / `ConsoleBreakGlass` promotion now requires real CloudTrail event evidence rather than probe liveness.\n\n#### Workarounds\n\nSetting `options.minConfidence: \"medium\"` on the classifier call prevents the degraded `None / none` from being cached (it doesn't meet the threshold), partially mitigating case (1). No workaround for case (2).\n\n#### Resources\n\n- [PR #178](https://github.com/kerberosmansour/hulumi/pull/178) (Cluster D); regression tests in `packages/drift/tests/classifier-fail-closed.test.ts`.","status":"published","published":"2026-06-10T13:38:50Z","modified":"2026-06-10T13:38:50Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:40:24.856614Z"}],"nvd":[{"id":"CVE-2026-48036","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T19:16:58.753Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T14:12:32.830533Z"}],"osv":[{"id":"CVE-2026-48036","title":"Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T18:44:05.631Z","modified":"2026-10-28T02:31:10.932266724Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-32g3-35g9-wc9g","title":"@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts","description":"**Affected:** `@hulumi/drift` `\u003c 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-755 (Improper Handling of Exceptional Conditions)**\n\n#### Summary\n\n`@hulumi/drift` runs four adapters that each ask a different question about whether a resource has drifted (Pulumi-state diff, provider-version change, CloudTrail event, etc.). A classifier combines the adapters' answers into a verdict like `None / none`, `ConsoleBreakGlass / high`, or `Mixed / high`, and caches the verdict for 6 hours by default.\n\nTwo related bugs from one root cause — the classifier only read each adapter's `detected: true/false` field and ignored whether the adapter itself succeeded:\n\n1. **Cached \"all clear\" on adapter failure.** When an adapter failed (e.g. transient network error from the Automation API), the classifier read `detected: false`, concluded \"no drift\", and cached the verdict as `None / none` for 6 hours. A single transient failure could mask real console-break-glass mutations for the rest of the window.\n2. **Mixed verdicts without real evidence.** The `Mixed / high` and `ConsoleBreakGlass / high` verdicts (incident severity) could fire on the \"the CloudTrail probe round-tripped successfully\" signal rather than actual evidence that anything had been changed via the console. Normal provider-API churn could end up falsely escalated to incident severity.\n\n#### Impact\n\nConsumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it.\n\n#### Patches\n\nUpgrade to `@hulumi/drift@1.4.0`. Classifier-only fix (the TLA+-verified 6-row verdict matrix is byte-identical):\n\n- adapter failures now fail closed to `Unknown / low`, and degraded verdicts are not written to the cache;\n- the `Mixed` / `ConsoleBreakGlass` promotion now requires real CloudTrail event evidence rather than probe liveness.\n\n#### Workarounds\n\nSetting `options.minConfidence: \"medium\"` on the classifier call prevents the degraded `None / none` from being cached (it doesn't meet the threshold), partially mitigating case (1). No workaround for case (2).\n\n#### Resources\n\n- [PR #178](https://github.com/kerberosmansour/hulumi/pull/178) (Cluster D); regression tests in `packages/drift/tests/classifier-fail-closed.test.ts`.","status":"published","published":"2026-06-10T13:38:50Z","modified":"2026-09-10T03:51:07.508902477Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L","level":"high"}],"cwes":["CWE-755"],"updated_at":"2026-11-02T15:46:35.050232Z"}]}}