CVE-2026-48035 Hulumi: AccountFoundation audit-delivery S3 bucket could be silently weakened
Attackers with S3 delete permissions can silently delete CloudTrail and Config audit logs, bypassing tamper-resistance guarantees in Hulumi AccountFoundation deployments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48035?
CVE-2026-48035 is a high-severity vulnerability in kerberosmansour hulumi, published on 24 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while believing the startup-hardened tier guaranteed tamper-resistance. Sandbox-tier deployments had no audit immutability at all (defects 1 and 3 compounded). This issue has been patched in version 1.4.0.
Weakness: CWE-1059
Which versions are affected by CVE-2026-48035?
2 open source packages ship an affected version, including @hulumi/baseline.
| Package | Affected | Fixed in |
|---|---|---|
@hulumi/baseline npm | All versions | 1.4.0 |
@hulumi/baseline npm | All versions | 1.4.0 |
How do I fix CVE-2026-48035?
Upgrade @hulumi/baseline to 1.4.0 or later.
Is CVE-2026-48035 being exploited?
There is no known exploitation of CVE-2026-48035 in the wild and no public exploit code.
Sources
Also known as GHSA-2mxr-p26x-mj73.