hulumi has 6 CVEs on record. Disclosures have slowed: 0 in the last 90 days after 6 in the 90 before. The busiest recent month was June 2026 with 6. None have a confirmed exploitation report. Most affected products: @hulumi/policies (3), @hulumi/baseline (2), @hulumi/drift (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- —
- Publish → KEV
- —
- Last 90 days
- 0 prev 6
Weakness classes
Products
- @hulumi/policies 3
- @hulumi/baseline 2
- @hulumi/drift 1
Worst active — by depth score
CVE-2026-48036High@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts41CVE-2026-48035High@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened41CVE-2026-48034High@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket41CVE-2026-48033High@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name41CVE-2026-48032High@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers41
hulumi vulnerabilities
CVEs affecting hulumi, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-48032High@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
CVE-2026-48033High@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name
CVE-2026-48034High@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
CVE-2026-48035High@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened
CVE-2026-48036High@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts
CVE-2026-48037Medium@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture
@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture