What’s Vulnerable › Vulnerabilities

CVE-2026-48036: Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

• Severity: high (CVSS 8.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-24 · updated 2026-10-24
• Weakness: CWE-755

Description

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.

Affected products

• kerberosmansour hulumi: before 1.4.0

References

• https://github.com/kerberosmansour/hulumi/pull/178
• https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0
• https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g

Get alerted when CVE-2026-48036 or the next vulnerability affects your stack