CVE-2026-48036: high-severity vulnerability in kerberosmansour hulumi
Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.4epss 0.5%
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
Affected products
kerberosmansour · hulumiRelated CVEs — kerberosmansour hulumi
In the same product, most dangerous first.
CVE-2026-82859CRITICALhulumi before v1.3.2 SCP Template Tag-on-Create BypassEPSS 0.5%CVE-2026-48032HIGHHulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providersEPSS 0.5%CVE-2026-82857CRITICALhulumi before v1.3.2 Privilege Escalation via IAM PolicyEPSS 0.5%CVE-2026-48033HIGHHulumi: Policy packs bypassed by a forged Pulumi-URN logical nameEPSS 0.5%CVE-2026-48037MEDIUMHulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub postureEPSS 0.5%CVE-2026-48035HIGHHulumi: AccountFoundation audit-delivery S3 bucket could be silently weakenedEPSS 0.5%