CVE-2026-48032: kerberosmansour Hulumi IAM policy bypass in @hulumi/policies

CVE-2026-48032 · Severity: high · CVSS 4 · Published 2026-07-24

Hulumi is a toolkit used to build secure cloud infrastructure. A flaw in its security policy engine allowed certain identity permissions (IAM roles) to bypass safety checks if they were configured to trust multiple login providers simultaneously. This could allow an attacker to gain unauthorized access to cloud environments, potentially leading to full administrative control or data exposure, while the system incorrectly reported that the configuration was secure.

Technologies: @hulumi/policies (npm). Vendors: npm.

Quick answers

Is CVE-2026-48032 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48032 being exploited in the wild.
How severe is CVE-2026-48032?
High severity, with a CVSS score of 4, published 24 July 2026.
Which products and versions are affected?
@hulumi/policies (npm) < 1.4.0, SEMVER:introduced=0,fixed=1.4.0.
Is there a fix for CVE-2026-48032?
Yes. @hulumi/policies (npm): upgrade to 1.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48032 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48032?
Check whether you run @hulumi/policies (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @hulumi/policies (npm): upgrade to 1.4.0 or later
    npm install @hulumi/policies@1.4.0

Technical details

A vulnerability exists in the @hulumi/policies package where IAM-role policy checks (G_OIDC_1 and G_OIDC_2) can be bypassed. The root cause is an incorrect comparison (CWE-697) when the Principal.Federated field in an AWS IAM trust policy contains an array of multiple providers. The toolkit coerced the provider list into a single comma-joined string, causing the matcher to fail to identify the GitHub OIDC provider. Consequently, the policy engine would skip critical wildcard 'sub' condition checks and blast-radius validations. An attacker could exploit this by configuring a role with a wildcard condition that allows untrusted entities (such as pull requests from forks) to assume highly privileged roles. The issue is patched in version 1.4.0.

Affected products

  • kerberosmansour @hulumi/policies < 1.4.0

Identifiers

  • CVE-2026-48032
  • GHSA-g759-4pxw-6692

Timeline

  • 2026-05-19: other: Fixes merged in pull request 178
  • 2026-05-20: patched: Version 1.4.0 released
  • 2026-07-24: disclosed: CVE-2026-48032 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.