Read the docs
TI-2026-35479 Aliases CVE-2026-48036GHSA-32g3-35g9-wc9g

Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Priority MEDIUM 43CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00511 43rd percentileScored 2026-11-07
Fix Fixed hulumi (kerberosmansour): 1.4.0@hulumi/drift (npm): 1.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kerberosmansourhulumibefore 1.4.01.4.0Patch availableCNA
—@hulumi/drift (npm)before 1.4.01.4.0Patch availableGHSA-32g3-35g9-wc9g
  • hulumi Vendorkerberosmansour Affected before 1.4.0 Fixed in 1.4.0 Patch available CNA
  • @hulumi/drift (npm) Vendor— Affected before 1.4.0 Fixed in 1.4.0 Patch available GHSA-32g3-35g9-wc9g

Remediation

  • Fix · CNA hulumi (kerberosmansour) Fixed in 1.4.0
  • Fix · GHSA-32g3-35g9-wc9g @hulumi/drift (npm) Fixed in 1.4.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48036
  2. 2026-10-03 Alias added: GHSA-32g3-35g9-wc9g

References

Other 4

  • TI-2026-57163 hulumi before v1.3.2 SCP Template Tag-on-Create Bypass CVSS 4.0CRITICAL 9.3
  • TI-2026-57161 hulumi before v1.3.2 Privilege Escalation via IAM Policy CVSS 4.0CRITICAL 9.3
  • TI-2026-35475 Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers CVSS 4.0HIGH 8.3
  • TI-2026-57166 Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files CVSS 4.0HIGH 8.6
  • TI-2026-35477 HULUMI-H5 bypass via decoy sibling resources targeting a different bucket CVSS 4.0HIGH 8.5
  • TI-2026-35476 Hulumi: Policy packs bypassed by a forged Pulumi-URN logical name CVSS 4.0HIGH 8.4
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences