CVE-2026-48036: Hulumi Drift Detection Vulnerability

CVE-2026-48036 Overview

CVE-2026-48036 affects Hulumi, an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Versions prior to 1.4.0 mishandle exceptional conditions in the drift detection verdict pipeline. Consumers running drift detection in continuous integration (CI) or cron jobs can observe transient adapter failures silently cached as "all clear" for up to six hours. This behavior masks real attacks against infrastructure. Alternatively, ordinary provider-version churn is falsely promoted to incident severity, generating noise in downstream incident workflows. The verdict source becomes unreliable for any workflow that gates on drift results. Version 1.4.0 patches the issue.

Critical Impact
Improper error handling in Hulumi drift detection can suppress genuine infrastructure attack signals for up to six hours or trigger false incident escalations, degrading integrity of downstream security workflows.

Affected Products

Hulumi versions prior to 1.4.0
Pulumi environments consuming Hulumi drift detection components
CI and cron pipelines gating on Hulumi verdicts

Discovery Timeline

2026-07-24 - CVE-2026-48036 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-48036

Vulnerability Analysis

The flaw is classified as [CWE-755] Improper Handling of Exceptional Conditions. Hulumi's drift detection subsystem produces a verdict consumed by CI, cron jobs, and incident-response gating logic. When an adapter fails transiently, the pipeline caches the fallback state as an "all clear" verdict. Downstream consumers treat this cached verdict as authoritative for the cache window, which extends up to six hours. During that window, real infrastructure drift or active tampering is not surfaced. In the opposite failure mode, routine provider-version churn triggers verdict changes that map to incident severity. The result is a bimodal integrity failure: silent suppression of true positives and inflation of false positives.

Root Cause

The root cause is inconsistent error handling in the drift verdict pipeline. Transient adapter faults are not distinguished from confirmed clean states, and provider-version differences are not normalized before verdict computation. Both conditions feed into the same output channel that gates downstream security actions.

Attack Vector

The attack vector is network-based with user interaction required (AV:N/UI:P). An attacker who can induce transient adapter failures, or who times malicious infrastructure changes to align with the six-hour cache window, can suppress drift alerts. Integrity impact on the vulnerable system is high (VI:H) and integrity impact on subsequent systems is high (SI:H), reflecting the trust downstream workflows place in the verdict.

No verified public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-32g3-35g9-wc9g for technical details.

Detection Methods for CVE-2026-48036

Indicators of Compromise

Drift detection verdicts that remain "all clear" across multiple consecutive runs despite known infrastructure changes
Adapter error log entries immediately preceding cached clean verdicts
Sudden spikes in drift incident tickets correlated with provider or plugin upgrades

Detection Strategies

Compare Hulumi verdict outputs against a secondary source of truth such as cloud provider audit logs or Pulumi state history
Alert when adapter errors are logged within the same job that emits an "all clear" verdict
Track verdict cache age and flag consumption of verdicts older than a defined threshold

Monitoring Recommendations

Ingest Hulumi CI and cron job logs into a centralized log platform for correlation with cloud provider change events
Monitor Pulumi provider version changes and correlate with drift verdict flips to identify false-positive noise
Instrument the drift pipeline to emit distinct telemetry for adapter failures versus clean scans

How to Mitigate CVE-2026-48036

Immediate Actions Required

Upgrade Hulumi to version 1.4.0 or later across all CI, cron, and developer environments
Invalidate any cached drift verdicts produced by vulnerable versions and rerun drift detection
Audit downstream incident workflows that gate on Hulumi verdicts and confirm they revalidate before acting

Patch Information

The issue is patched in Hulumi version 1.4.0. See the GitHub Release v1.4.0 and the associated GitHub Pull Request for the code changes that harden exceptional-condition handling in the drift verdict pipeline.

Workarounds

Disable caching of drift verdicts until the upgrade is applied
Require a secondary verification source before any automated incident escalation or suppression
Pin provider versions in Pulumi projects to reduce noise from version churn while remediation is in progress

bash

# Upgrade Hulumi to the patched release
pip install --upgrade 'hulumi>=1.4.0'

# Verify installed version
hulumi --version