CVE-2026-48033
Received Received - Intake

Hulumi Policy Pack Bypass via Forged Pulumi-URN

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: GitHub, Inc.

Description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-25
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-48033
EUVD
EUVD-2026-48724

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hulumi hulumi to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Hulumi is an open-source toolkit for secure cloud infrastructure. Prior to version 1.4.0, a vulnerability allowed bypassing policy packs by forging a Pulumi-URN logical name. This means unauthorized changes could be made without detection.

Detection Guidance

To detect this vulnerability, inspect Pulumi URNs in your infrastructure for logical names containing trusted substrings like 'hulumi:baseline:aws:SecureBucket$' in the logical name portion. Check policy pack versions before 1.4.0 and verify if resources bypass mandatory security checks due to forged URNs.

Impact Analysis

This vulnerability could allow attackers to bypass security policies, leading to unauthorized modifications in cloud infrastructure. This may result in data breaches, service disruptions, or compliance violations depending on the environment.

Compliance Impact

Bypassing security policies could lead to unauthorized access or changes, violating data protection requirements in GDPR or HIPAA. Compliance may be compromised if sensitive data is exposed or altered without proper controls.

Mitigation Strategies

Update Hulumi to version 1.4.0 or later to patch the policy bypass vulnerability. Review Pulumi-URN logical names for any suspicious or unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48033. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart