Vulnerability in Kerberosmansour Hulumi

CVE-2026-48037

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.

EPSS: 0.003 (17.5th percentile) — read the EPSS interpretation.

Affected products

Kerberosmansour Hulumi — versions < 1.4.0

Weakness classification (CWE)

CWE-693 — Protection Mechanism Failure

References

security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_CONFIRM)