CVE-2026-48036
Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
- State
- Published
- Severity
- 8.4 High
- Published
- Jul 24, 2026
- Updated
- Jul 25, 2026
- Reserved
- May 20, 2026
Description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.4 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L | GitHub_M |
Weaknesses
- CWE-755 Improper Handling of Exceptional Conditions
Affected Products
| Product | Versions |
|---|---|
hulumikerberosmansour |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.