CVE-2026-48037: Hulumi Pulumi Security Posture Downgrade

CVE-2026-48037 Overview

CVE-2026-48037 affects Hulumi, an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade Amazon GuardDuty and AWS Security Hub posture. The defect maps to CWE-693: Protection Mechanism Failure, meaning security controls that operators expect to be active can be quietly weakened without visible errors. The maintainers patched the issue in version 1.4.0.

Critical Impact
Cloud accounts provisioned through reused AccountFoundation paths can run with reduced threat detection coverage, leaving GuardDuty and Security Hub findings incomplete or absent for affected AWS accounts.

Affected Products

Hulumi toolkit versions prior to 1.4.0
AWS accounts provisioned via Hulumi AccountFoundation reuse paths
Pulumi stacks consuming Hulumi security posture components

Discovery Timeline

2026-07-24 - CVE-2026-48037 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-48037

Vulnerability Analysis

Hulumi provides opinionated, secure-by-default building blocks for Pulumi-managed AWS environments. The AccountFoundation component is intended to enforce baseline detective controls, including GuardDuty threat detection and Security Hub aggregation. When operators re-run or reuse AccountFoundation on an account that already has partial state, the reuse code paths do not reassert the full posture. The result is a silent downgrade of detection coverage rather than a hard failure or drift alert.

Because the downgrade is silent, downstream reviewers see a successful Pulumi apply and assume the account remains compliant. Detection gaps can persist across audit cycles until an incident exposes them.

Root Cause

The root cause is a protection mechanism failure inside the AccountFoundation reuse logic. Instead of reconciling the desired secure baseline against the observed account state, the reuse paths accept the existing configuration as authoritative. GuardDuty detectors, finding publishing frequency, and Security Hub standards subscriptions can therefore end in a weaker state than the module's defaults describe.

Attack Vector

This vulnerability is not a direct remote exploit. An authenticated actor with permission to trigger Pulumi deployments, or a workflow that reuses an AccountFoundation against an account with prior state, can cause the downgrade. The attack vector is network-adjacent through CI/CD or Pulumi automation. The primary impact is loss of security integrity: findings that would otherwise flag reconnaissance, credential abuse, or malicious IP traffic may never be generated. See the GitHub Security Advisory GHSA-cj8g-prcm-mfg5 for the maintainer analysis.

Detection Methods for CVE-2026-48037

Indicators of Compromise

GuardDuty detectors in affected accounts showing FindingPublishingFrequency other than the Hulumi baseline, or missing threat intelligence and malware protection features.
Security Hub standards subscriptions absent or partially enabled where Hulumi previously declared them.
Pulumi state files referencing AccountFoundation reuse paths without corresponding change events in GuardDuty or Security Hub configuration history.

Detection Strategies

Compare the effective GuardDuty and Security Hub configuration in each AWS account against the Hulumi 1.4.0 declared baseline and flag any deltas.
Query AWS Config and CloudTrail for UpdateDetector, DisableOrganizationAdminAccount, and BatchDisableStandards events correlated with Pulumi deployment identities.
Audit Pulumi run logs for AccountFoundation reuse invocations and cross-check with change records in the corresponding accounts.

Monitoring Recommendations

Continuously monitor GuardDuty detector status and Security Hub standards enablement across all organization accounts.
Alert on any transition from enabled to disabled for GuardDuty features such as S3 protection, EKS protection, and malware protection.
Treat any silent reduction in detective control coverage as a change management incident and require re-approval before proceeding.

How to Mitigate CVE-2026-48037

Immediate Actions Required

Upgrade all Hulumi consumers to version 1.4.0 or later and redeploy stacks that use AccountFoundation.
Inventory every AWS account previously provisioned via AccountFoundation reuse paths and validate GuardDuty and Security Hub posture against the intended baseline.
Re-enable any GuardDuty features or Security Hub standards found to be downgraded and document the remediation in change records.

Patch Information

The maintainers released the fix in Hulumi v1.4.0. Details are documented in the GitHub Release v1.4.0 and the corresponding GitHub Pull Request #178. The advisory record is published as GHSA-cj8g-prcm-mfg5.

Workarounds

Pin Pulumi projects to Hulumi 1.4.0 or newer in dependency manifests and lock files, and block older versions in the build pipeline.
Add an out-of-band compliance check that reconciles GuardDuty and Security Hub configuration against the intended baseline after every Pulumi apply.
Restrict use of AccountFoundation reuse paths on accounts with pre-existing state until the upgrade is verified across the environment.

bash

# Upgrade Hulumi in a Pulumi project using npm
npm install @kerberosmansour/hulumi@^1.4.0

# Or for Python-based Pulumi projects
pip install --upgrade 'hulumi>=1.4.0'

# Re-run Pulumi to reassert the secure baseline
pulumi up --refresh