CVE-2026-48034
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
In Hulumi prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket.
Risk Assessment
The organization risks that an attacker can bypass security mechanisms and gain unauthorized access to resources or data.
Recommendation
It is recommended to update Hulumi to version 1.4.0 or later.
Other vulnerabilities in Hulumi
See all- CVE-2026-48037Medium
Hulumi prior to version 1.4.0 contains a vulnerability where AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.
- CVE-2026-48036High
In Hulumi prior to version 1.4.0, drift detection in CI/cron could silently cache transient adapter failures as 'all clear', masking real attacks for up to six hours, or falsely escalate ordinary provider-version churn to incident severity.
- CVE-2026-48035High
In Hulumi prior to version 1.4.0, users of AccountFoundation could deploy an AWS account whose CloudTrail/Config audit logs were deletable by any S3-delete-capable principal, despite the startup-hardened tier guaranteeing tamper-resistance. Sandbox deployments had no audit immutability.
- CVE-2026-48033High
In Hulumi prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name.
- CVE-2026-48032High
In Hulumi prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers.
Original NVD description (English source)
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.