Executive brief
@hulumi/baseline is an AWS CloudTrail security monitoring library that detects unauthorized changes to audit logging configurations. The vulnerability allows attackers to tamper with CloudTrail event selectors without triggering full detection coverage, potentially allowing malicious changes to logging configuration to go unnoticed and enabling attackers to hide their activities from audit logs.
Technical details
The vulnerability is an insufficient logging issue (CWE-778) where @hulumi/baseline versions before 1.3.2 failed to detect all CloudTrail event-selector tampering evidence. This reduced security coverage for changes to critical audit logging configurations. The root cause lies in incomplete detection logic that missed certain tampering patterns. An attacker with permissions to modify CloudTrail configuration could exploit this to disable or modify event selectors while evading detection. The vulnerability requires network access to AWS CloudTrail APIs and appropriate AWS credentials. The fix was applied in version 1.3.2, which expanded detection coverage and added regression tests.
Affected products
- @hulumi baseline before 1.3.2
Timeline
- 2026-05-21: disclosed
- 2026-05-21: patched: Version 1.3.2 released