Vulnerability details
CVE-2026-48036
kerberosmansour hulumi
Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
CVSS 4.0
8.4High
Official description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.4High | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| kerberosmansour | hulumi | < 1.4.0 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g x_refsource_CONFIRM
- https://github.com/kerberosmansour/hulumi/pull/178 x_refsource_MISC
- https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0 x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-24
- Last updated
- 2026-07-25
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.51%
Probability of exploitation in 30 days
43.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-755Improper Handling of Exceptional Conditions