CVE-2026-48034: kerberosmansour Hulumi security policy bypass via decoy sibling resources

CVE-2026-48034 · Severity: high · CVSS 4 · Published 2026-07-24

Hulumi is an open-source toolkit used to deploy secure cloud infrastructure. In versions prior to 1.4.0, a security flaw allowed attackers to bypass infrastructure hardening policies by using "decoy" resources. This could allow an attacker to deploy insecure cloud components, such as S3 buckets without encryption or public access protections, while making them appear compliant to security scanners.

Technologies: Kerberosmansour Hulumi, @hulumi/policies (npm). Vendors: Kerberosmansour, npm.

Quick answers

Is CVE-2026-48034 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48034 being exploited in the wild.
How severe is CVE-2026-48034?
High severity, with a CVSS score of 4, published 24 July 2026.
Which products and versions are affected?
Hulumi Policies < 1.4.0; Kerberosmansour Hulumi < 1.4.0; @hulumi/policies (npm) < 1.4.0, SEMVER:introduced=0,fixed=1.4.0.
Is there a fix for CVE-2026-48034?
Yes. @hulumi/policies (npm): upgrade to 1.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48034 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48034?
Check whether you run Hulumi Policies, Kerberosmansour Hulumi or @hulumi/policies (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @hulumi/policies (npm): upgrade to 1.4.0 or later
    npm install @hulumi/policies@1.4.0

Technical details

A vulnerability in Hulumi's policy engine (specifically the H5 hardening pack) allowed for a bypass of security controls via unanchored URN matching and lack of resource binding. The H5 stack policy accepted any hardening resources under the same URN prefix without verifying that they actually targeted the exempted S3 bucket. This allowed an attacker to provide "decoy" sibling resources that appeared to satisfy security requirements (like TLS-only access or server-side encryption) but actually pointed to different, unrelated buckets. Additionally, the TLS-only bucket policy check was insufficient as it only looked for a Deny on 'aws:SecureTransport' without validating Action or Resource coverage. The issue is fixed in version 1.4.0 by implementing strict URN anchoring and binding hardening checks to specific bucket identifiers.

Affected products

  • kerberosmansour Hulumi < 1.4.0

Identifiers

  • CVE-2026-48034
  • GHSA-9vc9-4jv3-rf86

Timeline

  • 2026-05-19: patched: Fixes merged in PR #178
  • 2026-05-20: advisory: Release v1.4.0 published
  • 2026-07-24: disclosed: CVE-2026-48034 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.