Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-82862 (GCVE-0-2026-82862)

Vulnerability from nvd – Published: 2026-08-31 08:46 – Updated: 2026-08-31 08:46

Title

Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Summary

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-426 - Untrusted Search Path

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	vendor-advisory
https://www.vulncheck.com/advisories/hulumi-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: 0 , < 1.3.2 (semver) Unaffected: 1.3.2 (semver)

Date Public

2026-05-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "lessThan": "1.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.3.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-05-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T08:46:33.895Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-mjcg-x5mr-27ww)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-mjcg-x5mr-27ww"
        },
        {
          "name": "VulnCheck Advisory: Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hulumi-before-1.3.2-helper-script-shadowing-via-workspace-files"
        }
      ],
      "title": "Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82862",
    "datePublished": "2026-08-31T08:46:33.895Z",
    "dateReserved": "2026-08-31T08:37:27.054Z",
    "dateUpdated": "2026-08-31T08:46:33.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82859 (GCVE-0-2026-82859)

Vulnerability from nvd – Published: 2026-08-31 08:46 – Updated: 2026-08-31 08:46

Title

hulumi before v1.3.2 SCP Template Tag-on-Create Bypass

Summary

hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-284 - Improper Access Control

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	vendor-advisory
https://www.vulncheck.com/advisories/hulumi-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: 0 , < 1.3.2 (semver) Unaffected: 1.3.2 (semver)

Date Public

2026-05-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "lessThan": "1.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.3.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-05-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T08:46:31.849Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-86q4-r5j3-ff5c)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-86q4-r5j3-ff5c"
        },
        {
          "name": "VulnCheck Advisory: hulumi before v1.3.2 SCP Template Tag-on-Create Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hulumi-before-1.3.2-scp-template-tag-on-create-bypass"
        }
      ],
      "title": "hulumi before v1.3.2 SCP Template Tag-on-Create Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82859",
    "datePublished": "2026-08-31T08:46:31.849Z",
    "dateReserved": "2026-08-31T08:37:27.054Z",
    "dateUpdated": "2026-08-31T08:46:31.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82857 (GCVE-0-2026-82857)

Vulnerability from nvd – Published: 2026-08-31 08:46 – Updated: 2026-08-31 08:46

Title

hulumi before v1.3.2 Privilege Escalation via IAM Policy

Summary

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	vendor-advisory
https://www.vulncheck.com/advisories/hulumi-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: 0 , < 1.3.2 (semver) Unaffected: 1.3.2 (semver)

Date Public

2026-05-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "lessThan": "1.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.3.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-05-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T08:46:30.487Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-35qr-vx94-m5x3)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-35qr-vx94-m5x3"
        },
        {
          "name": "VulnCheck Advisory: hulumi before v1.3.2 Privilege Escalation via IAM Policy",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hulumi-before-1.3.2-privilege-escalation-via-iam-policy"
        }
      ],
      "title": "hulumi before v1.3.2 Privilege Escalation via IAM Policy",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82857",
    "datePublished": "2026-08-31T08:46:30.487Z",
    "dateReserved": "2026-08-31T08:37:27.053Z",
    "dateUpdated": "2026-08-31T08:46:30.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48037 (GCVE-0-2026-48037)

Vulnerability from nvd – Published: 2026-07-24 18:44 – Updated: 2026-07-27 16:05

Title

Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 16:05 UTC

CWE

CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48037",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T16:05:27.380255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T16:05:37.812Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:44:23.652Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-cj8g-prcm-mfg5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-cj8g-prcm-mfg5"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cj8g-prcm-mfg5",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48037",
    "datePublished": "2026-07-24T18:44:23.652Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-27T16:05:37.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48036 (GCVE-0-2026-48036)

Vulnerability from nvd – Published: 2026-07-24 18:44 – Updated: 2026-07-25 00:58

Title

Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-25 00:58 UTC

CWE

CWE-755 - Improper Handling of Exceptional Conditions

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-25T00:58:12.887741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-25T00:58:23.970Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" \u2014 masking real attacks for up to six hours \u2014 or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755: Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:44:05.631Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-32g3-35g9-wc9g",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48036",
    "datePublished": "2026-07-24T18:44:05.631Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-25T00:58:23.970Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48035 (GCVE-0-2026-48035)

Vulnerability from nvd – Published: 2026-07-24 18:43 – Updated: 2026-07-27 20:23

Title

Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 17:26 UTC

CWE

CWE-1059 - Insufficient Technical Documentation

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48035",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T17:26:10.575563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T20:23:56.410Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal \u2014 while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1059",
              "description": "CWE-1059: Insufficient Technical Documentation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:43:35.696Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-2mxr-p26x-mj73",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-2mxr-p26x-mj73"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2mxr-p26x-mj73",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48035",
    "datePublished": "2026-07-24T18:43:35.696Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-27T20:23:56.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48034 (GCVE-0-2026-48034)

Vulnerability from nvd – Published: 2026-07-24 18:38 – Updated: 2026-07-24 20:15

Title

HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 20:15 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/175	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48034",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T20:15:09.201783Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T20:15:32.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:38:53.735Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-9vc9-4jv3-rf86",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-9vc9-4jv3-rf86"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/175",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/175"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-9vc9-4jv3-rf86",
        "discovery": "UNKNOWN"
      },
      "title": "HULUMI-H5 bypass via decoy sibling resources targeting a different bucket"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48034",
    "datePublished": "2026-07-24T18:38:53.735Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-24T20:15:32.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48033 (GCVE-0-2026-48033)

Vulnerability from nvd – Published: 2026-07-24 18:39 – Updated: 2026-07-24 19:16

Title

Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 19:16 UTC

CWE

CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T19:16:09.870254Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T19:16:19.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:39:18.532Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-rhgj-6g2c-frmm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-rhgj-6g2c-frmm"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rhgj-6g2c-frmm",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48033",
    "datePublished": "2026-07-24T18:39:18.532Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-24T19:16:19.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48032 (GCVE-0-2026-48032)

Vulnerability from nvd – Published: 2026-07-24 18:39 – Updated: 2026-07-27 17:20

Title

Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 17:20 UTC

CWE

CWE-697 - Incorrect Comparison

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48032",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T17:20:21.486757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T17:20:38.935Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-697",
              "description": "CWE-697: Incorrect Comparison",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:39:05.061Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-g759-4pxw-6692",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48032",
    "datePublished": "2026-07-24T18:39:05.061Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-27T17:20:38.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82862 (GCVE-0-2026-82862)

Vulnerability from cvelistv5 – Published: 2026-08-31 08:46 – Updated: 2026-08-31 08:46

Title

Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Summary

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-426 - Untrusted Search Path

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	vendor-advisory
https://www.vulncheck.com/advisories/hulumi-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: 0 , < 1.3.2 (semver) Unaffected: 1.3.2 (semver)

Date Public

2026-05-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "lessThan": "1.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.3.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-05-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script. Attackers can place malicious files in the workspace to execute arbitrary code during local skill execution."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T08:46:33.895Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-mjcg-x5mr-27ww)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-mjcg-x5mr-27ww"
        },
        {
          "name": "VulnCheck Advisory: Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hulumi-before-1.3.2-helper-script-shadowing-via-workspace-files"
        }
      ],
      "title": "Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82862",
    "datePublished": "2026-08-31T08:46:33.895Z",
    "dateReserved": "2026-08-31T08:37:27.054Z",
    "dateUpdated": "2026-08-31T08:46:33.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82859 (GCVE-0-2026-82859)

Vulnerability from cvelistv5 – Published: 2026-08-31 08:46 – Updated: 2026-08-31 08:46

Title

hulumi before v1.3.2 SCP Template Tag-on-Create Bypass

Summary

hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-284 - Improper Access Control

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	vendor-advisory
https://www.vulncheck.com/advisories/hulumi-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: 0 , < 1.3.2 (semver) Unaffected: 1.3.2 (semver)

Date Public

2026-05-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "lessThan": "1.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.3.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-05-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T08:46:31.849Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-86q4-r5j3-ff5c)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-86q4-r5j3-ff5c"
        },
        {
          "name": "VulnCheck Advisory: hulumi before v1.3.2 SCP Template Tag-on-Create Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hulumi-before-1.3.2-scp-template-tag-on-create-bypass"
        }
      ],
      "title": "hulumi before v1.3.2 SCP Template Tag-on-Create Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82859",
    "datePublished": "2026-08-31T08:46:31.849Z",
    "dateReserved": "2026-08-31T08:37:27.054Z",
    "dateUpdated": "2026-08-31T08:46:31.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-82857 (GCVE-0-2026-82857)

Vulnerability from cvelistv5 – Published: 2026-08-31 08:46 – Updated: 2026-08-31 08:46

Title

hulumi before v1.3.2 Privilege Escalation via IAM Policy

Summary

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-269 - Improper Privilege Management

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	vendor-advisory
https://www.vulncheck.com/advisories/hulumi-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: 0 , < 1.3.2 (semver) Unaffected: 1.3.2 (semver)

Date Public

2026-05-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "lessThan": "1.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.3.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-05-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T08:46:30.487Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-35qr-vx94-m5x3)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-35qr-vx94-m5x3"
        },
        {
          "name": "VulnCheck Advisory: hulumi before v1.3.2 Privilege Escalation via IAM Policy",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/hulumi-before-1.3.2-privilege-escalation-via-iam-policy"
        }
      ],
      "title": "hulumi before v1.3.2 Privilege Escalation via IAM Policy",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-82857",
    "datePublished": "2026-08-31T08:46:30.487Z",
    "dateReserved": "2026-08-31T08:37:27.053Z",
    "dateUpdated": "2026-08-31T08:46:30.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48037 (GCVE-0-2026-48037)

Vulnerability from cvelistv5 – Published: 2026-07-24 18:44 – Updated: 2026-07-27 16:05

Title

Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 16:05 UTC

CWE

CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48037",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T16:05:27.380255Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T16:05:37.812Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:44:23.652Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-cj8g-prcm-mfg5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-cj8g-prcm-mfg5"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cj8g-prcm-mfg5",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48037",
    "datePublished": "2026-07-24T18:44:23.652Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-27T16:05:37.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48036 (GCVE-0-2026-48036)

Vulnerability from cvelistv5 – Published: 2026-07-24 18:44 – Updated: 2026-07-25 00:58

Title

Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-25 00:58 UTC

CWE

CWE-755 - Improper Handling of Exceptional Conditions

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48036",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-25T00:58:12.887741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-25T00:58:23.970Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" \u2014 masking real attacks for up to six hours \u2014 or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-755",
              "description": "CWE-755: Improper Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:44:05.631Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-32g3-35g9-wc9g",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48036",
    "datePublished": "2026-07-24T18:44:05.631Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-25T00:58:23.970Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48035 (GCVE-0-2026-48035)

Vulnerability from cvelistv5 – Published: 2026-07-24 18:43 – Updated: 2026-07-27 20:23

Title

Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 17:26 UTC

CWE

CWE-1059 - Insufficient Technical Documentation

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48035",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T17:26:10.575563Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T20:23:56.410Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal \u2014 while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1059",
              "description": "CWE-1059: Insufficient Technical Documentation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:43:35.696Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-2mxr-p26x-mj73",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-2mxr-p26x-mj73"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2mxr-p26x-mj73",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48035",
    "datePublished": "2026-07-24T18:43:35.696Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-27T20:23:56.410Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48033 (GCVE-0-2026-48033)

Vulnerability from cvelistv5 – Published: 2026-07-24 18:39 – Updated: 2026-07-24 19:16

Title

Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0.

Severity

8.4 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 19:16 UTC

CWE

CWE-693 - Protection Mechanism Failure

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T19:16:09.870254Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T19:16:19.349Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693: Protection Mechanism Failure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:39:18.532Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-rhgj-6g2c-frmm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-rhgj-6g2c-frmm"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rhgj-6g2c-frmm",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48033",
    "datePublished": "2026-07-24T18:39:18.532Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-24T19:16:19.349Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48032 (GCVE-0-2026-48032)

Vulnerability from cvelistv5 – Published: 2026-07-24 18:39 – Updated: 2026-07-27 17:20

Title

Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-27 17:20 UTC

CWE

CWE-697 - Incorrect Comparison

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48032",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-27T17:20:21.486757Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-27T17:20:38.935Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-697",
              "description": "CWE-697: Incorrect Comparison",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:39:05.061Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-g759-4pxw-6692",
        "discovery": "UNKNOWN"
      },
      "title": "Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48032",
    "datePublished": "2026-07-24T18:39:05.061Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-27T17:20:38.935Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48034 (GCVE-0-2026-48034)

Vulnerability from cvelistv5 – Published: 2026-07-24 18:38 – Updated: 2026-07-24 20:15

Title

HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-24 20:15 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/kerberosmansour/hulumi/securit…	x_refsource_CONFIRM
https://github.com/kerberosmansour/hulumi/pull/175	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/pull/178	x_refsource_MISC
https://github.com/kerberosmansour/hulumi/release…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
kerberosmansour	hulumi	Affected: < 1.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48034",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-24T20:15:09.201783Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-24T20:15:32.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hulumi",
          "vendor": "kerberosmansour",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T18:38:53.735Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-9vc9-4jv3-rf86",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-9vc9-4jv3-rf86"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/175",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/175"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/pull/178",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/pull/178"
        },
        {
          "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-9vc9-4jv3-rf86",
        "discovery": "UNKNOWN"
      },
      "title": "HULUMI-H5 bypass via decoy sibling resources targeting a different bucket"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48034",
    "datePublished": "2026-07-24T18:38:53.735Z",
    "dateReserved": "2026-05-20T18:15:53.577Z",
    "dateUpdated": "2026-07-24T20:15:32.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

18 vulnerabilities found for hulumi by kerberosmansour

CVE-2026-82862 (GCVE-0-2026-82862)

CVE-2026-82859 (GCVE-0-2026-82859)

CVE-2026-82857 (GCVE-0-2026-82857)

CVE-2026-48037 (GCVE-0-2026-48037)

CVE-2026-48036 (GCVE-0-2026-48036)

CVE-2026-48035 (GCVE-0-2026-48035)

CVE-2026-48034 (GCVE-0-2026-48034)

CVE-2026-48033 (GCVE-0-2026-48033)

CVE-2026-48032 (GCVE-0-2026-48032)

CVE-2026-82862 (GCVE-0-2026-82862)

CVE-2026-82859 (GCVE-0-2026-82859)

CVE-2026-82857 (GCVE-0-2026-82857)

CVE-2026-48037 (GCVE-0-2026-48037)

CVE-2026-48036 (GCVE-0-2026-48036)

CVE-2026-48035 (GCVE-0-2026-48035)

CVE-2026-48033 (GCVE-0-2026-48033)

CVE-2026-48032 (GCVE-0-2026-48032)

CVE-2026-48034 (GCVE-0-2026-48034)