Executive brief
The Hulumi drift detection service monitors infrastructure for unauthorized changes by combining signals from multiple adapters. Two bugs in the classifier cause unreliable incident detection: transient adapter failures are silently cached as "no drift detected" for 6 hours, masking real attacks, and normal infrastructure changes can be falsely escalated to incident-level severity alerts. This makes downstream security workflows that depend on accurate drift verdicts unreliable.
Technical details
The vulnerability stems from CWE-755 (Improper Handling of Exceptional Conditions) in the drift classifier. The classifier combines verdicts from four adapters (Pulumi state, provider version, CloudTrail events) by reading only the detected: true/false field while ignoring adapter success/failure status. Two bugs result: (1) when an adapter fails (e.g., transient network error), the classifier reads detected: false and caches the verdict as None/none for 6 hours, masking real console-break-glass mutations; (2) Mixed/high and ConsoleBreakGlass/high verdicts are promoted based on CloudTrail probe round-trip success rather than actual evidence of console changes, causing false escalation of normal provider-API churn. The fix in v1.4.0 makes adapter failures fail closed to Unknown/low, prevents degraded verdicts from being cached, and requires real CloudTrail event evidence for incident-severity verdicts. A partial workaround exists via options.minConfidence: "medium" to prevent degraded None/none from caching.
Affected products
- hulumi @hulumi/drift < 1.4.0
Timeline
- 2026-06-10: disclosed: GHSA-32g3-35g9-wc9g published
- 2026-05-19: patched: Fix merged in PR #178; released in v1.4.0