Executive brief
@hulumi/drift is a reconciliation library used in orchestration workflows to validate and execute infrastructure changes. Versions before 1.3.2 fail to verify that execute plans originate from trusted sources, allowing an attacker to inject malicious reconciliation instructions that are processed as legitimate. This could result in unauthorized infrastructure modifications or data loss in systems that depend on this library.
Technical details
The vulnerability is an insufficient data authenticity verification issue (CWE-345) in the orphan reconciler component. @hulumi/drift before version 1.3.2 accepts externally supplied execute plans without performing adequate provenance validation, treating untrusted input as trustworthy. An attacker with network access to supply execute plans can craft malicious reconciliation instructions that bypass integrity checks. The patch in 1.3.2 introduces provenance validation logic that rejects execute plans failing authenticity verification, with regression test coverage. Remediation requires upgrading to @hulumi/drift 1.3.2 or later.
Affected products
- hulumi @hulumi/drift before 1.3.2
Timeline
- 2026-05-21: disclosed: Advisory published
- 2026-05-21: patched: Fix released in version 1.3.2