Transient Adapter Failures in Hulumi Open-Source Toolkit Affecting Cloud Infrastructure
CVE-2026-48036
8.4HIGH
What is CVE-2026-48036?
The Hulumi open-source toolkit experienced a significant vulnerability prior to the release of version 1.4.0. Users running drift detection in Continuous Integration (CI) or cron jobs encountered transient adapter failures that were incorrectly cached as 'all clear'. This created a risk of masking genuine attacks for up to six hours and led to misclassification of regular provider-version changes as severe incidents. Such unreliable verdicts jeopardized incident workflows, making it essential for users to upgrade to version 1.4.0, which addresses these critical issues and improves overall security integrity.
Affected Version(s)
hulumi < 1.4.0