CVE-2026-48036

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48036", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-20T18:15:53.577Z", "datePublished": "2026-07-24T18:44:05.631Z", "dateUpdated": "2026-07-25T00:58:23.970Z"}, "containers": {"cna": {"title": "Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts", "problemTypes": [{"descriptions": [{"cweId": "CWE-755", "lang": "en", "description": "CWE-755: Improper Handling of Exceptional Conditions", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g"}, {"name": "https://github.com/kerberosmansour/hulumi/pull/178", "tags": ["x_refsource_MISC"], "url": "https://github.com/kerberosmansour/hulumi/pull/178"}, {"name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"}], "affected": [{"vendor": "kerberosmansour", "product": "hulumi", "versions": [{"version": "< 1.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-24T18:44:05.631Z"}, "descriptions": [{"lang": "en", "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" \u2014 masking real attacks for up to six hours \u2014 or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0."}], "source": {"advisory": "GHSA-32g3-35g9-wc9g", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-25T00:58:12.887741Z", "id": "CVE-2026-48036", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-25T00:58:23.970Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48036", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-25T00:58:12.887741Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-25T00:58:20.820Z"}}], "cna": {"title": "Hulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts", "source": {"advisory": "GHSA-32g3-35g9-wc9g", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "kerberosmansour", "product": "hulumi", "versions": [{"status": "affected", "version": "< 1.4.0"}]}], "references": [{"url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g", "name": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/kerberosmansour/hulumi/pull/178", "name": "https://github.com/kerberosmansour/hulumi/pull/178", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0", "name": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" \u2014 masking real attacks for up to six hours \u2014 or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-755", "description": "CWE-755: Improper Handling of Exceptional Conditions"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-24T18:44:05.631Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48036", "state": "PUBLISHED", "dateUpdated": "2026-07-25T00:58:23.970Z", "dateReserved": "2026-05-20T18:15:53.577Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-24T18:44:05.631Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hulumi", "vendor": "kerberosmansour", "versions": [{"status": "affected", "version": "< 1.4.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, consumers running drift detection in CI / cron could see transient adapter failures silently cached as \"all clear\" \u2014 masking real attacks for up to six hours \u2014 or see ordinary provider-version churn falsely promoted to incident severity. Either way, the verdict source was unreliable for downstream incident workflows that gate on it. This issue has been patched in version 1.4.0."}, {"lang": "es", "value": "Hulumi es un conjunto de herramientas de c\u00f3digo abierto que distribuye componentes de infraestructura de nube y plataforma seguros por defecto para Pulumi. Antes de la versi\u00f3n 1.4.0, los usuarios que ejecutaban detecci\u00f3n de desv\u00edos en CI / cron pod\u00edan ver fallos transitorios del adaptador almacenados en cach\u00e9 silenciosamente como \u2019todo despejado\u2019 - enmascarando ataques reales durante hasta seis horas - o ver la rotaci\u00f3n ordinaria de versiones del proveedor falsamente elevada a gravedad de incidente. De cualquier manera, la fuente del veredicto no era fiable para los flujos de trabajo de incidentes posteriores que la utilizan como criterio. Este problema ha sido parcheado en la versi\u00f3n 1.4.0."}], "id": "CVE-2026-48036", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48036", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-25T00:58:12.887741Z", "version": "2.0.3"}}]}, "published": "2026-07-24T19:16:58.753", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/kerberosmansour/hulumi/pull/178"}, {"source": "security-advisories@github.com", "url": "https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-32g3-35g9-wc9g"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "hulumi", "source": "cna", "vendor": "kerberosmansour"}, "product": "hulumi", "vendor": "kerberosmansour"}], "created": "2026-07-26T03:00:08.786285+00:00", "updated": "2026-08-03T20:00:12.977933+00:00", "vendors": ["kerberosmansour", "kerberosmansour$PRODUCT$hulumi"]}