Hulumi vulnerabilities
6 known CVE vulnerabilities in Hulumi, translated and rated.
- CVE-2026-48037Medium
Hulumi prior to version 1.4.0 contains a vulnerability where AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.
- CVE-2026-48036High
In Hulumi prior to version 1.4.0, drift detection in CI/cron could silently cache transient adapter failures as 'all clear', masking real attacks for up to six hours, or falsely escalate ordinary provider-version churn to incident severity.
- CVE-2026-48035High
In Hulumi prior to version 1.4.0, users of AccountFoundation could deploy an AWS account whose CloudTrail/Config audit logs were deletable by any S3-delete-capable principal, despite the startup-hardened tier guaranteeing tamper-resistance. Sandbox deployments had no audit immutability.
- CVE-2026-48034High
In Hulumi prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket.
- CVE-2026-48033High
In Hulumi prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name.
- CVE-2026-48032High
In Hulumi prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers.