CVE-2026-48032
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In Hulumi prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers.
Risk Assessment
The organization risks that an attacker can gain unauthorized IAM permissions by bypassing security checks.
Recommendation
It is recommended to update Hulumi to version 1.4.0 or later.
Other vulnerabilities in Hulumi
See all- CVE-2026-48037Medium
Hulumi prior to version 1.4.0 contains a vulnerability where AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.
- CVE-2026-48036High
In Hulumi prior to version 1.4.0, drift detection in CI/cron could silently cache transient adapter failures as 'all clear', masking real attacks for up to six hours, or falsely escalate ordinary provider-version churn to incident severity.
- CVE-2026-48035High
In Hulumi prior to version 1.4.0, users of AccountFoundation could deploy an AWS account whose CloudTrail/Config audit logs were deletable by any S3-delete-capable principal, despite the startup-hardened tier guaranteeing tamper-resistance. Sandbox deployments had no audit immutability.
- CVE-2026-48034High
In Hulumi prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket.
- CVE-2026-48033High
In Hulumi prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name.
Original NVD description (English source)
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0.