CVE-2026-82863

Published: Aug 31, 2026Modified: Aug 31, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

@hulumi/baseline versions before 1.3.2 fail to fully detect CloudTrail selector tampering events, reducing audit logging configuration change coverage. Attackers can modify CloudTrail event selectors without complete detection, potentially evading audit trail monitoring.

Related CWEs

CWE-778

Insufficient Logging

When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.

References (2)

https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-gfp8-mp24-5vxg

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/hulumi-baseline-before-1.3.2-cloudtrail-selector-tampering-detection

Source: disclosure@vulncheck.com

Timeline

No history available yet.