# CVE-2026-82858

## Summary

- **CVE ID:** CVE-2026-82858
- **Severity:** CRITICAL
- **CVSS Score:** 9.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- **CWE:** CWE-345
- **Published:** Aug 31, 2026
- **Last Modified:** Aug 31, 2026

## Description

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.

## Affected Products

- hulumi — drift (0)
- hulumi — drift (1.3.2)

## References

- [CNA](https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-2ffm-hxrq-qqmm)
- [CNA](https://www.vulncheck.com/advisories/hulumi-drift-before-1.3.2-unsafe-execute-plan-acceptance)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.19%
- **EPSS Percentile:** 8.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._