CVE-2026-48032 Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers
Attackers can bypass IAM-role policy checks in Hulumi when roles trust multiple OIDC providers, potentially escalating privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48032?
CVE-2026-48032 is a high-severity authentication bypass vulnerability in kerberosmansour hulumi, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0.
Weakness: CWE-697
Which versions are affected by CVE-2026-48032?
2 open source packages ship an affected version, including @hulumi/policies.
| Package | Affected | Fixed in |
|---|---|---|
@hulumi/policies npm | All versions | 1.4.0 |
@hulumi/policies npm | All versions | 1.4.0 |
How do I fix CVE-2026-48032?
Upgrade @hulumi/policies to 1.4.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-48032 being exploited?
There is no known exploitation of CVE-2026-48032 in the wild and no public exploit code.
Sources
Also known as GHSA-g759-4pxw-6692.