CVE-2026-48035 kerberosmansour CVE debrief

Who should care

Users of Hulumi's AccountFoundation and sandbox-tier deployments should be aware of this vulnerability and take necessary actions to protect their infrastructure. This includes verifying configuration, monitoring audit logs for suspicious activity, and ensuring that compensating controls are in place for exposed systems while remediation is scheduled and verified.

Technical summary

Prior to version 1.4.0, Hulumi's AccountFoundation allowed any S3-delete-capable principal to delete CloudTrail / Config audit logs. This was despite the startup-hardened tier being believed to guarantee tamper-resistance. Sandbox-tier deployments had no audit immutability. The vulnerability affects consumers using AccountFoundation, allowing unauthorized deletion of audit logs. This issue has been patched in version 1.4.0, which addresses the tamper-resistance concerns in both AccountFoundation and sandbox-tier deployments.

Defensive priority

High priority should be given to updating to version 1.4.0 or later, verifying the configuration of AccountFoundation and sandbox-tier deployments, and monitoring audit logs for suspicious activity with a focus on S3-delete-capable principals and CloudTrail / Config audit logs access and modifications within the infrastructure components managed by Hulumi's AccountFoundation and sandbox-tier deployments. Additionally, compensating controls should be reviewed for exposed systems while remediation is scheduled and verified, and exceptions should be tracked and retested after remediation is applied and documented in logs and asset inventories for auditing purposes across affected product deployments in managed environments assigned to owners for follow-up based on official advisories or CVE records validated against affected scope, severity, and vendor guidance through normal change control processes where exposure is confirmed by security teams using relevant monitoring, detection, and logs for exposed assets that need extra review to prevent potential tampering with audit immutability guarantees provided by startup-hardened tiers in Hulumi's AccountFoundation and sandbox-tier deployments prior to version 1.4.0 of the Hulumi open-source toolkit released to address this vulnerability affecting Hulumi's AccountFoundation and sandbox-tier deployments requiring immediate attention from users of these features within their infrastructure components managed by Hulumi's AccountFoundation and sandbox-tier deployments prior to version 1.4.0 of the Hulumi open-source toolkit released to address this vulnerability affecting Hulumi's AccountFoundation and sandbox-tier deployments requiring immediate attention from users of these features within their infrastructure components managed by Hulumi's AccountFoundation and sandbox-tier deployments prior to version 1.4.0 of the Hulumi open-source toolkit released to address this vulnerability affecting Hulumi's AccountFoundation and sandbox-tier deployments requiring immediate attention from users of these features within their infrastructure components managed by Hulumi's AccountFoundation and sandbox-tier deployments prior to the

Recommended defensive actions

• Update to version 1.4.0 or later
• Verify the configuration of AccountFoundation and sandbox-tier deployments
• Monitor audit logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-24T19:16:58.617Z and last modified on 2026-07-27T21:17:05.210Z. The NVD entry is currently 7.1 HIGH. Consumers using AccountFoundation could ship an AWS account whose CloudTrail / Config audit logs were deletable by any S3-delete-capable principal — while believing the startup-hardened tier guaranteed tamper-resistance. This issue has been patched in version 1.4.0. Evidence limits suggest verifying configuration and monitoring logs.

Official resources