SEPTEMBER 20, 2026
Live Feed
Back to database
Case File

CVE-2026-48032

HIGH · CVSS 8.3 EPSS 0.31% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-24 · Last synced 2026-08-23

CyberRota Analysis

AI-Generated

Prior to version 1.4.0, Hulumi's open-source toolkit is vulnerable to IAM-role policy bypass when roles trust multiple OIDC providers, potentially allowing unauthorized access to cloud resources. Organizations using Hulumi for cloud infrastructure management should prioritize upgrading to version 1.4.0 to mitigate this security risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-48032
Severity
HIGH
CVSS
8.3
EPSS
0.31%

Original NVD Description

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0.