CVE-2026-48036
Last modified
CVE-2026-48036 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| kerberosmansour | hulumi | < 1.4.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-48036?
How severe is CVE-2026-48036?
How do I fix CVE-2026-48036?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-48030Pheditor is a single-file editor and file manager written in…9.9
- CVE-2026-48031go-base is a Go RESTful API Boilerplate template with JWT Au…9.1
- CVE-2026-48032Hulumi is an open-source toolkit that ships secure-by-defaul…8.3
- CVE-2026-48033Hulumi is an open-source toolkit that ships secure-by-defaul…8.4
- CVE-2026-48034Hulumi is an open-source toolkit that ships secure-by-defaul…8.5
- CVE-2026-48035Hulumi is an open-source toolkit that ships secure-by-defaul…7.1
- CVE-2026-48037Hulumi is an open-source toolkit that ships secure-by-defaul…6.3
- CVE-2026-48038joi is a schema description language and data validator for …5.3
- CVE-2026-48039Meta Ads MCP is a Model Context Protocol (MCP) server that l…9.1
- CVE-2026-4804The Zakra theme for WordPress is vulnerable to Stored Cross-…6.4
- CVE-2026-48040The netty incubator codec.bhttp is a java language binary ht…9.1
- CVE-2026-48042Envoy is an open source edge and service proxy designed for …7.5
Are you affected by CVE-2026-48036?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST