CVE-2026-48036 Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
Attackers can mask real infrastructure attacks or trigger false incidents by exploiting drift classifier failures in Hulumi, undermining security monitoring reliability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-48036?
CVE-2026-48036 is a high-severity vulnerability in kerberosmansour hulumi, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as "all clear" — masking real attacks for up to six hours — or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0.
Weakness: CWE-755
Which versions are affected by CVE-2026-48036?
2 open source packages ship an affected version, including @hulumi/drift.
| Package | Affected | Fixed in |
|---|---|---|
@hulumi/drift npm | All versions | 1.4.0 |
@hulumi/drift npm | All versions | 1.4.0 |
How do I fix CVE-2026-48036?
Upgrade @hulumi/drift to 1.4.0 or later.
Is CVE-2026-48036 being exploited?
There is no known exploitation of CVE-2026-48036 in the wild and no public exploit code.
Sources
Also known as GHSA-32g3-35g9-wc9g.