CVE-2026-82863: Insufficient Logging in hulumi baseline

@hulumi/baseline versions prior to 1.3.2 have insufficient logging capabilities that fail to fully detect tampering with CloudTrail event selectors. CloudTrail event selectors define which events are logged for auditing purposes. If attackers modify these selectors without detection, audit logs may not capture all relevant configuration changes, weakening security monitoring and forensic capabilities. This vulnerability has a CVSS 4.0 score of 8.7, indicating high severity with network attack vector, no privileges required, and high impact on confidentiality.

Attackers can modify CloudTrail event selectors without complete detection, which reduces audit logging coverage of configuration changes. This can lead to incomplete audit trails, making it harder to detect unauthorized changes or malicious activity related to CloudTrail configurations. The vulnerability impacts the integrity of audit logs and monitoring systems relying on @hulumi/baseline for detection.

Upgrade @hulumi/baseline to version 1.3.2 or later, where this issue is fixed. No other mitigation guidance is provided. Patch status is confirmed by the affectedVersions field indicating versions <1.3.2 are vulnerable and 1.3.2 is the fixed version.