Read the docs
TI-2026-35478 Aliases CVE-2026-48035GHSA-2mxr-p26x-mj73

Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened

Priority LOW 32CWE-1059Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00451 39th percentileScored 2026-11-07
Fix Fixed hulumi (kerberosmansour): 1.4.0@hulumi/baseline (npm): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kerberosmansourhulumibefore 1.4.01.4.0Patch availableCNA
—@hulumi/baseline (npm)before 1.4.01.4.0Patch availableGHSA-2mxr-p26x-mj73
  • hulumi Vendorkerberosmansour Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA
  • @hulumi/baseline (npm) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-2mxr-p26x-mj73

Remediation

  • Fix · CNA hulumi (kerberosmansour) Fixed in 1.4.0
  • Fix · GHSA-2mxr-p26x-mj73 @hulumi/baseline (npm) Fixed in 1.4.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48035
  2. 2026-10-03 Alias added: GHSA-2mxr-p26x-mj73

References

Other 4

  • TI-2026-57163 hulumi before v1.3.2 SCP Template Tag-on-Create Bypass CVSS 4.0CRITICAL 9.3
  • TI-2026-57161 hulumi before v1.3.2 Privilege Escalation via IAM Policy CVSS 4.0CRITICAL 9.3
  • TI-2026-35479 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts CVSS 4.0HIGH 8.4
  • TI-2026-35475 Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers CVSS 4.0HIGH 8.3
  • TI-2026-57166 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files CVSS 4.0HIGH 8.6
  • TI-2026-35477 HULUMI-H5 bypass via decoy sibling resources targeting a different bucket CVSS 4.0HIGH 8.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences