{"id":"GHSA-cj8g-prcm-mfg5","revision":"63d8f2fbdab640cc825b0820cb74b606","records":[{"revision":"63d8f2fbdab640cc825b0820cb74b606","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-cj8g-prcm-mfg5","aliases":["CVE-2026-48037"],"title":"@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture","description":"**Affected:** `@hulumi/baseline` `< 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-693 (Protection Mechanism Failure)**\n\n#### Summary\n\n`AccountFoundation` can either create AWS detective services (GuardDuty for threat detection, Security Hub for compliance dashboards) or reuse pre-existing ones via opt-in flags. The reuse paths just imported the existing resources and reported success — they never checked whether the existing services were actually doing their job.\n\n1. **GuardDuty reuse.** If the existing detector was suspended, or set to the slower 6-hour publishing cadence instead of the baseline 15-minute one, or otherwise misconfigured — Hulumi never noticed. The deployment succeeded with a misleadingly-positive `guardDutyDetectorId` output as if the baseline were active.\n2. **Security Hub reuse.** Although the account import was read-only, Hulumi unconditionally created the CIS / NIST `StandardsSubscription` resources with default delete behaviour. Pulumi then treated those subscriptions as its own — a later `pulumi destroy` of the stack would call `BatchDisableStandards`, unsubscribing the account from CIS / NIST compliance monitoring even on accounts that had those subscriptions before Hulumi ever ran.\n\n#### Impact\n\nConsumers using `AccountFoundation`'s reuse mode could:\n\n- ship deployments that appeared to enable a detective baseline but actually weren't (case 1), or\n- accidentally turn off CIS / NIST compliance monitoring on an existing account just by destroying a Hulumi stack (case 2 — no malicious intent needed; a normal stack teardown was enough).\n\n#### Patches\n\nUpgrade to `@hulumi/baseline@1.4.0`.\n\n- GuardDuty reuse now asserts the imported detector is `ENABLED` with `findingPublishingFrequency: FIFTEEN_MINUTES`. Wrong posture fails the deploy at preview time.\n- Security Hub reuse creates the CIS / NIST `StandardsSubscription` resources with `retainOnDelete: true`, so destroying a reused stack no longer unsubscribes the account.\n\nNet-new (non-reuse) deployments are unchanged.\n\n#### Workarounds\n\nDon't reuse pre-existing detective services with `AccountFoundation` before upgrading. If reuse is unavoidable, manually verify detector posture out-of-band.\n\n#### Resources\n\n- [PR #178](https://github.com/kerberosmansour/hulumi/pull/178) (Cluster G); regression tests in\n  `packages/baseline/tests/guardduty-reuse-posture.test.ts` and\n  `packages/baseline/tests/securityhub-reuse-retain.test.ts`.","state":0,"publishedAt":"2026-06-10T13:38:59+00:00","modifiedAt":"2026-09-10T03:51:08.4804929+00:00","affected":[{"ecosystem":"npm","name":"@hulumi/baseline","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.4.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-cj8g-prcm-mfg5","https://github.com/kerberosmansour/hulumi/pull/178","https://github.com/kerberosmansour/hulumi"],"sourceUrl":"https://github.com/advisories/GHSA-cj8g-prcm-mfg5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-cj8g-prcm-mfg5","identifiers":["GHSA-cj8g-prcm-mfg5","CVE-2026-48037"]},"retained":false,"historicalAffected":[]}],"coverage":[]}