https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T09:42:44.376826+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-341052 EUVD-2026-341052 2026-10-06T09:42:44.428481+00:00 EUVD-2026-341052 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48036 fkie_cve-2026-48036 2026-10-06T09:42:44.428533+00:00

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.

 https://cve.radiocsirt.org/vuln/ghsa-32g3-35g9-wc9g GHSA-32g3-35g9-wc9g — @hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts 2026-10-06T09:42:44.428587+00:00

Affected: npm: @hulumi/drift

**Affected:** `@hulumi/drift` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-755 (Improper Handling of Exceptional Conditions)**

#### Summary

`@hulumi/drift` runs four adapters that each ask a different question about whether a resource has drifted (Pulumi-state diff, provider-version change, CloudTrail event, etc.). A classifier combines the adapters' answers into a verdict like `None / none`, `ConsoleBreakGlass / high`, or `Mixed / high`, and caches the verdict for 6 hours by default.

Two related bugs from one root cause — the classifier only read each adapter's `detected: true/false` field and ignored whether the adapter itself succeeded:

1. **Cached "all clear" on adapter failure.** When an adapter failed (e.g. transient network error from the Automation API), the classifier read `detected: false`, concluded "no drift", and cached the verdict as `None / none` for 6 hours. A single transient failure could mask real console-break-glass mutations for the rest of the window. 2. **Mixed verdicts without real evidence.** The `Mixed / high` and `ConsoleBreakGlass / high` verdicts (incident severity) could fire on the "the CloudTrail probe round-tripped successfully" signal rather than actual evidence that anything had been changed via the console. Normal provider-API churn could end up falsely escalated to incident severity.

#### Impact

Consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — ma…