CVE-2026-48032 kerberosmansour CVE debrief

Who should care

Users of Hulumi versions prior to 1.4.0 who utilize IAM roles with multiple OIDC providers should be aware of this security issue and take steps to upgrade to version 1.4.0 or apply compensating controls. Operators, platform administrators, and security teams responsible for managing and securing infrastructure components should evaluate the potential impact and implement necessary mitigations.

Technical summary

The Hulumi open-source toolkit, used for secure-by-default cloud and platform infrastructure components for Pulumi, had a security issue prior to version 1.4.0. The vulnerability allowed for the bypass of IAM-role policy checks in scenarios where a role trusts multiple OpenID Connect (OIDC) providers. This issue was addressed with the release of version 1.4.0. Users of affected versions should evaluate their configurations and apply the necessary patches or mitigations.

Defensive priority

High

Recommended defensive actions

• Upgrade to Hulumi version 1.4.0 or later
• Review and update IAM roles and OIDC provider configurations
• Monitor for suspicious activity related to IAM role policy checks
• Verify affected versions and configurations in your environment
• Evaluate the severity and potential impact of this issue in your context
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD entry provide information on the issue and its resolution. Additional details can be found in the referenced GitHub pull request, release notes, and security advisory. Users should verify the affected versions and configurations, and review the vendor's guidance for applying the patch. The issue's severity and potential impact should be evaluated in the context of the specific deployment environment.

Official resources