Vulnerability · Published Jul 24, 2026 · Assigned by GitHub_M
CVE-2026-48036Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
High 8.4
In plain English
A high-severity security flaw in hulumi from kerberosmansour. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @hulumi/drift | 1.4.0 | GHSA-32g3-35g9-wc9g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| kerberosmansour | hulumi | < 1.4.0 |
Weakness: CWE-755 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
References
- https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g x_refsource_CONFIRM
- https://github.com/kerberosmansour/hulumi/pull/178 x_refsource_MISC
- https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0 x_refsource_MISC