CVE-2026-48036

Name of the Vulnerable Software and Affected Versions @hulumi/drift versions prior to 1.4.0

Description An issue exists in the classifier of the drift detection toolkit where it only evaluates the detected field of adapters and ignores whether the adapter itself succeeded. This leads to two scenarios: transient adapter failures (such as network errors from the Automation API) are interpreted as no drift, causing a None / none verdict to be cached for up to six hours and potentially masking real attacks. Additionally, normal provider-API churn can be falsely escalated to incident severity, triggering Mixed / high or ConsoleBreakGlass / high verdicts without actual evidence of unauthorized changes.

Recommendations Upgrade @hulumi/drift to version 1.4.0. As a temporary mitigation for cached false negatives, set options.minConfidence: "medium" on the classifier call to prevent degraded None / none verdicts from being cached.