Executive brief
Hulumi is an open-source toolkit used to deploy secure cloud infrastructure. In versions prior to 1.4.0, a security flaw allowed attackers to bypass infrastructure hardening policies by using "decoy" resources. This could allow an attacker to deploy insecure cloud components, such as S3 buckets without encryption or public access protections, while making them appear compliant to security scanners.
Technical details
A vulnerability in Hulumi's policy engine (specifically the H5 hardening pack) allowed for a bypass of security controls via unanchored URN matching and lack of resource binding. The H5 stack policy accepted any hardening resources under the same URN prefix without verifying that they actually targeted the exempted S3 bucket. This allowed an attacker to provide "decoy" sibling resources that appeared to satisfy security requirements (like TLS-only access or server-side encryption) but actually pointed to different, unrelated buckets. Additionally, the TLS-only bucket policy check was insufficient as it only looked for a Deny on 'aws:SecureTransport' without validating Action or Resource coverage. The issue is fixed in version 1.4.0 by implementing strict URN anchoring and binding hardening checks to specific bucket identifiers.
Affected products
- kerberosmansour Hulumi < 1.4.0
Timeline
- 2026-05-19: patched: Fixes merged in PR #178
- 2026-05-20: advisory: Release v1.4.0 published
- 2026-07-24: disclosed: CVE-2026-48034 published