Vulnerability in Kerberosmansour Hulumi

CVE-2026-48033

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0.

EPSS: 0.003 (19.7th percentile) — read the EPSS interpretation.

Affected products

Kerberosmansour Hulumi — versions < 1.4.0

Weakness classification (CWE)

CWE-693 — Protection Mechanism Failure

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)