CVE-2026-48035
Received Received - Intake

Hulumi AccountFoundation Audit Log Tampering Vulnerability

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: GitHub, Inc.

Description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-25
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-48035
EUVD
EUVD-2026-48725

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hulumi accountfoundation to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1059 The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Hulumi's AccountFoundation toolkit prior to version 1.4.0 allowed AWS account deployments where CloudTrail and Config audit logs could be deleted by any principal with S3 delete permissions. This created a false sense of security since users expected tamper-resistant logs due to startup hardening. Sandbox-tier deployments lacked audit immutability entirely.

Detection Guidance

Check if your @hulumi/baseline version is below 1.4.0 using npm list @hulumi/baseline. Inspect S3 bucket policies for audit-delivery buckets to ensure no s3:DeleteObject* permissions exist for non-admin principals. Verify CloudTrail and AWS Config logs are not deletable by unauthorized users.

Impact Analysis

This vulnerability allows unauthorized deletion of critical audit logs in AWS environments managed by Hulumi. Attackers could erase evidence of malicious activities, making it difficult to detect or investigate security incidents. Compliance violations may occur if logs required for audits are missing.

Compliance Impact

This vulnerability could lead to non-compliance with regulations requiring immutable audit logs such as GDPR (data protection accountability) and HIPAA (audit trail integrity). Deleted logs may prevent organizations from demonstrating compliance during audits or investigations.

Mitigation Strategies

Upgrade Hulumi to version 1.4.0 or later to address the audit log tampering vulnerability in AccountFoundation deployments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48035. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart