Is CVE-2026-82858 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82858?

CVE-2026-82858 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-82858

Description

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.