{"items":[{"id":"NVI-00020079","kind":"vulnerability","title":"@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-2mxr-p26x-mj73","CVE-2026-48035"],"plain_summary":"GitHub lists this reviewed advisory for @hulumi/baseline. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-74011e9c8afe83a91a82a8c86b72c10c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-74011e9c8afe83a91a82a8c86b72c10c","url":"https://github.com/advisories/GHSA-2mxr-p26x-mj73","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-2mxr-p26x-mj73","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T15:13:31.161Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-74011e9c8afe83a91a82a8c86b72c10c"],"technology":"@hulumi/baseline","known_exclusions":[],"conditions_summary":"**Affected:** `@hulumi/baseline` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** High — **CWE-1059 (Insufficient Technical Documentation / Behavioral Inconsistency)**\n\n#### Summary\n\nThe S3 bucket that `AccountFoundation` creates to receive CloudTrail and AWS Config audit logs is meant to be tamper-resistant — if someone with delete access can erase from it, the forensic trail is gone. There were three independent ways the protection could be silently weakened:\n\n1. **No Write-Once-Read-Many on the startup-hardened audit bucket.** The startup-hardened tier hard-coded `objectLock: false` on the audit bucket. (The reason was real — bucket-wide Object Lock blocks an AWS Config write-then-delete probe — but the fix was a sledgehammer that disabled WORM for all objects, not just the probe key.)\n2. **`forceDestroy` was forwarded to the audit bucket.** Nothing prevented a downstream stack from setting `logBucketForceDestroy: true`, which made `pulumi destroy` purge every audit-log object on teardown.\n3. **Sandbox tier dropped everything.** Sandbox-tier `AccountFoundation` created its audit bucket with `tier: \"sandbox\"`, which skipped Object Lock, server access logging, AND the CloudTrail-","public_affected_ranges":["< 1.4.0"]}],"null_published_at":"2026-11-08T15:11:47.523Z","source_updated_at":"2026-06-10T13:38:39.000Z","source_disclosed_at":"2026-06-10T13:38:37.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T15:13:31.161Z"}],"next_cursor":null,"snapshot_revision":"42594"}