← Vulnerability feed

Vulnerability record · CVE-2026-48032 · published 24 July 2026

CVE-2026-48032: Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for…

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0.

8.3 CVSS 4.0 High EPSS 0.54% · top 57.0% CWE-697 · CWE-697 Deferred
8.3CVSS 4.0 base score
0.54%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
3References
30 Jul 2026Last modified by NVD

Description

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://github.com/kerberosmansour/hulumi/pull/178
https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0
https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692

Track CVE-2026-48032 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2024-5217ServiceNow Now Platform input validation flaw enables unauthenticated RCEServiceNow's Washington DC, Vancouver, and earlier Now Platform releases contain an input validation vulnerability (CWE-184 incomplete list of disall…KEVEPSS 100%analysed7.5CVE-2020-5849Unraid authentication bypass in version 6.8.0Unraid 6.8.0 contains an authentication bypass (CWE-697, incorrect comparison) that lets an unauthenticated remote party get past login checks. The r…KEVEPSS 93%analysed

Source: NIST National Vulnerability Database (record CVE-2026-48032), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.