CVE-2026-48037
Received Received - Intake

AccountFoundation GuardDuty Security Hub Posture Downgrade in Hulumi

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: GitHub, Inc.

Description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-25
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-48037
EUVD
EUVD-2026-48727

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hulumi accountfoundation to 1.4.0 (exc)
hulumi accountfoundation 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Hulumi's AccountFoundation in versions before 1.4.0 has a flaw where reuse paths silently downgrade security posture in AWS GuardDuty and Security Hub. This means security monitoring and threat detection capabilities are weakened without clear indication to users.

Detection Guidance

To detect this vulnerability, check if your Hulumi AccountFoundation version is below 1.4.0. Run: npm list @hulumi/baseline. If the version is older, upgrade immediately. For AWS GuardDuty, verify detector status with: aws guardduty list-detectors and aws guardduty get-detector --detector-id <id>. Ensure detectors are not suspended. For Security Hub, check subscriptions with: aws securityhub list-findings-aggregators and aws securityhub describe-hub. Confirm subscriptions have retainOnDelete set to true.

Impact Analysis

If you use Hulumi AccountFoundation versions before 1.4.0, your AWS security monitoring may be less effective. This could allow threats to go undetected longer, increasing risk of data breaches or compliance violations. The issue is silent, so you might not realize your security posture is weakened.

Compliance Impact

The vulnerability allows AccountFoundation to silently downgrade GuardDuty and Security Hub posture, which could lead to insufficient security monitoring and controls. This may result in non-compliance with standards requiring robust security measures, such as GDPR's data protection requirements or HIPAA's security rule for protecting health information.

Mitigation Strategies

Upgrade Hulumi AccountFoundation to version 1.4.0 or later to address the GuardDuty and Security Hub posture downgrade issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart