{"id":"CVE-2026-48034","aliases":["EUVD-2026-48734","GHSA-9vc9-4jv3-rf86"],"status":"published","title":"HULUMI-H5 bypass via decoy sibling resources targeting a different bucket","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.","severity":{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00449,"percentile":0.39282,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2026-06-10T13:38:15Z","modified":"2026-10-28T02:30:23Z","fixes":[{"ecosystem":"npm","package":"@hulumi/policies","fixed_in":["1.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@hulumi/policies","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@hulumi/policies","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]}],"products":[{"vendor":"kerberosmansour","product":"hulumi"}],"references":[{"url":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-9vc9-4jv3-rf86","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/kerberosmansour/hulumi/pull/175","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/kerberosmansour/hulumi/pull/178","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-9vc9-4jv3-rf86"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48034.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48034","tags":["advisory"]},{"url":"https://github.com/kerberosmansour/hulumi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48034","title":"HULUMI-H5 bypass via decoy sibling resources targeting a different bucket","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T18:38:53.735Z","modified":"2026-07-24T20:15:32.345Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:50:49.872037Z"}],"euvd":[{"id":"EUVD-2026-48734","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T18:38:53Z","modified":"2026-07-24T20:15:32Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high"}],"updated_at":"2026-11-02T18:19:38.612768Z"}],"ghsa":[{"id":"GHSA-9vc9-4jv3-rf86","title":"@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket","description":"**Affected:** `@hulumi/policies` `\u003c 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** High — **CWE-284 (Improper Access Control)**\n\n#### Summary\n\nHULUMI-H1 forbids raw `aws:s3:Bucket` outside of Hulumi's `SecureBucket` component, with one exemption: a raw bucket that's a child of a `SecureBucket` is allowed because the component is responsible for the hardening. HULUMI-H5 is the defence-in-depth check that closes the H1 exemption — for any raw bucket claiming it, H5 verifies the five hardening sibling resources a real `SecureBucket` always emits (public-access block, SSE-KMS, ownership controls, versioning, TLS-only bucket policy) are actually present.\n\nThe bug: H5 only checked the siblings' _types_. It never verified that those siblings actually applied to the bucket being exempted. A consumer (or compromised PR) could pair an unhardened raw bucket with five hardening sibling resources whose `bucket` property pointed at a _completely different_ bucket, and H5 would report no violation while the actual bucket shipped with zero hardened defaults.\n\n#### Impact\n\nConsumers using `HulumiHardeningPack` could ship a raw S3 bucket with no public-access block, no SSE-KMS, no ownership controls, no versioning, and no TLS-only bucket policy — while the policy pack reported the stack as compliant.\n\n#### Patches\n\nUpgrade to `@hulumi/policies@1.4.0`. The H5 sibling check now requires both (a) the sibling to share the same parent `SecureBucket` instance via the anchored URN helper from GHSA-2, AND (b) the sibling's `bucket` property — or, for the bucket policy, its `Resource` ARN list — to reference the exempted bucket explicitly. Five decoy siblings pointing at a different bucket no longer count.\n\n#### Workarounds\n\nNone — the exemption itself is the mechanism, so the value-binding check is the only fix.\n\n#### Resources\n\n- [PR #178](https://github.com/kerberosmansour/hulumi/pull/178) (Cluster B); decoy-sibling regression cases in `packages/policies/tests/hulumi-hardening-pack.test.ts`. Supersedes [PR #175](https://github.com/kerberosmansour/hulumi/pull/175), which had addressed the value-binding half but on a stale base.","status":"published","published":"2026-06-10T13:38:15Z","modified":"2026-06-10T13:38:26Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:40:24.856614Z"}],"nvd":[{"id":"CVE-2026-48034","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T19:16:58.477Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:32.830533Z"}],"osv":[{"id":"CVE-2026-48034","title":"HULUMI-H5 bypass via decoy sibling resources targeting a different bucket","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, there is a bypass via decoy sibling resources targeting a different bucket. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T18:38:53.735Z","modified":"2026-10-28T02:30:23.206369878Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-9vc9-4jv3-rf86","title":"@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket","description":"**Affected:** `@hulumi/policies` `\u003c 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** High — **CWE-284 (Improper Access Control)**\n\n#### Summary\n\nHULUMI-H1 forbids raw `aws:s3:Bucket` outside of Hulumi's `SecureBucket` component, with one exemption: a raw bucket that's a child of a `SecureBucket` is allowed because the component is responsible for the hardening. HULUMI-H5 is the defence-in-depth check that closes the H1 exemption — for any raw bucket claiming it, H5 verifies the five hardening sibling resources a real `SecureBucket` always emits (public-access block, SSE-KMS, ownership controls, versioning, TLS-only bucket policy) are actually present.\n\nThe bug: H5 only checked the siblings' _types_. It never verified that those siblings actually applied to the bucket being exempted. A consumer (or compromised PR) could pair an unhardened raw bucket with five hardening sibling resources whose `bucket` property pointed at a _completely different_ bucket, and H5 would report no violation while the actual bucket shipped with zero hardened defaults.\n\n#### Impact\n\nConsumers using `HulumiHardeningPack` could ship a raw S3 bucket with no public-access block, no SSE-KMS, no ownership controls, no versioning, and no TLS-only bucket policy — while the policy pack reported the stack as compliant.\n\n#### Patches\n\nUpgrade to `@hulumi/policies@1.4.0`. The H5 sibling check now requires both (a) the sibling to share the same parent `SecureBucket` instance via the anchored URN helper from GHSA-2, AND (b) the sibling's `bucket` property — or, for the bucket policy, its `Resource` ARN list — to reference the exempted bucket explicitly. Five decoy siblings pointing at a different bucket no longer count.\n\n#### Workarounds\n\nNone — the exemption itself is the mechanism, so the value-binding check is the only fix.\n\n#### Resources\n\n- [PR #178](https://github.com/kerberosmansour/hulumi/pull/178) (Cluster B); decoy-sibling regression cases in `packages/policies/tests/hulumi-hardening-pack.test.ts`. Supersedes [PR #175](https://github.com/kerberosmansour/hulumi/pull/175), which had addressed the value-binding half but on a stale base.","status":"published","published":"2026-06-10T13:38:15Z","modified":"2026-09-10T03:50:55.291238325Z","cvss":[{"version":"4.0","score":8.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:L","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}