https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:32:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-341312 EUVD-2026-341312 https://cve.radiocsirt.org/vuln/euvd-2026-341312 https://cve.radiocsirt.org/vuln/fkie_cve-2026-48037 <p>Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.</p> <p>Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-48037 https://cve.radiocsirt.org/vuln/ghsa-cj8g-prcm-mfg5 <p><strong>Affected:</strong> npm: @hulumi/baseline</p> <p>**Affected:** `@hulumi/baseline` `&lt; 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-693 (Protection Mechanism Failure)**</p> <p>#### Summary</p> <p>`AccountFoundation` can either create AWS detective services (GuardDuty for threat detection, Security Hub for compliance dashboards) or reuse pre-existing ones via opt-in flags. The reuse paths just imported the existing resources and reported success — they never checked whether the existing services were actually doing their job.</p> <p>1. **GuardDuty reuse.** If the existing detector was suspended, or set to the slower 6-hour publishing cadence instead of the baseline 15-minute one, or otherwise misconfigured — Hulumi never noticed. The deployment succeeded with a misleadingly-positive `guardDutyDetectorId` output as if the baseline were active. 2. **Security Hub reuse.** Although the account import was read-only, Hulumi unconditionally created the CIS / NIST `StandardsSubscription` resources with default delete behaviour. Pulumi then treated those subscriptions as its own — a later `pulumi destroy` of the stack would call `BatchDisableStandards`, unsubscribing the account from CIS / NIST compliance monitoring even on accounts that had those subscriptions before Hulumi ever ran.</p> <p>#### Impact</p> <p>Consumers using `AccountFoundation`&#39;s reuse mode could:</p> <p>- ship deployments that appeared to enable a detective baseline but actually weren&#39;t (case 1), or - accidentally turn off CIS / NIST compliance monitoring on an existing account just b…</p> <p><strong>Affected:</strong> npm: @hulumi/baseline</p> <p>**Affected:** `@hulumi/baseline` `&lt; 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-693 (Protection Mechanism Failure)**</p> <p>#### Summary</p> <p>`AccountFoundation` can either create AWS detective services (GuardDuty for threat detection, Security Hub for compliance dashboards) or reuse pre-existing ones via opt-in flags. The reuse paths just imported the existing resources and reported success — they never checked whether the existing services were actually doing their job.</p> <p>1. **GuardDuty reuse.** If the existing detector was suspended, or set to the slower 6-hour publishing cadence instead of the baseline 15-minute one, or otherwise misconfigured — Hulumi never noticed. The deployment succeeded with a misleadingly-positive `guardDutyDetectorId` output as if the baseline were active. 2. **Security Hub reuse.** Although the account import was read-only, Hulumi unconditionally created the CIS / NIST `StandardsSubscription` resources with default delete behaviour. Pulumi then treated those subscriptions as its own — a later `pulumi destroy` of the stack would call `BatchDisableStandards`, unsubscribing the account from CIS / NIST compliance monitoring even on accounts that had those subscriptions before Hulumi ever ran.</p> <p>#### Impact</p> <p>Consumers using `AccountFoundation`&#39;s reuse mode could:</p> <p>- ship deployments that appeared to enable a detective baseline but actually weren&#39;t (case 1), or - accidentally turn off CIS / NIST compliance monitoring on an existing account just b…</p> https://cve.radiocsirt.org/vuln/ghsa-cj8g-prcm-mfg5