CVE-2026-48032

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48032", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:15:53.577Z", "datePublished": "2026-07-24T18:39:05.061Z", "dateUpdated": "2026-07-27T17:20:38.935Z"}, "containers": {"cna": {"title": "Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers", "problemTypes": [{"descriptions": [{"cweId": "CWE-697", "lang": "en", "description": "CWE-697: Incorrect Comparison", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692"}, {"name": "https://github.com/kerberosmansour/hulumi/pull/178", "tags": ["x_refsource_MISC"], "url": "https://github.com/kerberosmansour/hulumi/pull/178"}, {"name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"}], "affected": [{"vendor": "kerberosmansour", "product": "hulumi", "versions": [{"version": "< 1.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-24T18:39:05.061Z"}, "descriptions": [{"lang": "en", "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0."}], "source": {"advisory": "GHSA-g759-4pxw-6692", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T17:20:21.486757Z", "id": "CVE-2026-48032", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T17:20:38.935Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48032", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T17:20:21.486757Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T17:20:34.573Z"}}], "cna": {"title": "Hulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providers", "source": {"advisory": "GHSA-g759-4pxw-6692", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "kerberosmansour", "product": "hulumi", "versions": [{"status": "affected", "version": "< 1.4.0"}]}], "references": [{"url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692", "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kerberosmansour/hulumi/pull/178", "name": "https://github.com/kerberosmansour/hulumi/pull/178", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0", "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-697", "description": "CWE-697: Incorrect Comparison"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-24T18:39:05.061Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48032", "state": "PUBLISHED", "dateUpdated": "2026-07-27T17:20:38.935Z", "dateReserved": "2026-05-20T18:15:53.577Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-24T18:39:05.061Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hulumi", "vendor": "kerberosmansour", "versions": [{"status": "affected", "version": "< 1.4.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0."}, {"lang": "es", "value": "Hulumi es un conjunto de herramientas de c\u00f3digo abierto que distribuye componentes de infraestructura de nube y plataforma seguros por defecto para Pulumi. Antes de la versi\u00f3n 1.4.0, las comprobaciones de pol\u00edticas de roles de IAM pueden ser eludidas cuando el rol conf\u00eda en m\u00faltiples proveedores OIDC. Este problema ha sido parcheado en la versi\u00f3n 1.4.0."}], "id": "CVE-2026-48032", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48032", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-27T17:20:21.486757Z", "version": "2.0.3"}}]}, "published": "2026-07-24T19:16:58.190", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kerberosmansour/hulumi/pull/178"}, {"source": "security-advisories@github.com", "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g759-4pxw-6692"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-697"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "hulumi", "source": "cna", "vendor": "kerberosmansour"}, "product": "hulumi", "vendor": "kerberosmansour"}], "created": "2026-07-27T12:50:08.045879+00:00", "updated": "2026-08-03T20:00:12.979747+00:00", "vendors": ["kerberosmansour", "kerberosmansour$PRODUCT$hulumi"]}