CVE-2026-48036 HIGH

CVE-2026-48036: Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

Vendor Kerberosmansour
Product hulumi
Weakness CWE-755
Published July 24, 2026
Last update July 25, 2026
View on NVD All CVEs

CVSS base score

8.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

What the vulnerability does

01Description

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.

Key dates

02Disclosure timeline

July 24, 2026 CVE published
July 25, 2026 Record updated