{"id":"CVE-2026-48037","aliases":["EUVD-2026-48727","GHSA-cj8g-prcm-mfg5"],"status":"published","title":"Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00451,"percentile":0.39485,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2026-06-10T13:38:59Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"npm","package":"@hulumi/baseline","fixed_in":["1.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@hulumi/baseline","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@hulumi/baseline","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]}],"products":[{"vendor":"kerberosmansour","product":"hulumi"}],"references":[{"url":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-cj8g-prcm-mfg5","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/kerberosmansour/hulumi/pull/178","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/kerberosmansour/hulumi/releases/tag/v1.4.0","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-cj8g-prcm-mfg5"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48037.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48037","tags":["advisory"]},{"url":"https://github.com/kerberosmansour/hulumi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48037","title":"Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T18:44:23.652Z","modified":"2026-07-27T16:05:37.812Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-48727","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T18:44:23Z","modified":"2026-07-27T16:05:37Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:02:34.216106Z"}],"ghsa":[{"id":"GHSA-cj8g-prcm-mfg5","title":"@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture","description":"**Affected:** `@hulumi/baseline` `\u003c 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-693 (Protection Mechanism Failure)**\n\n#### Summary\n\n`AccountFoundation` can either create AWS detective services (GuardDuty for threat detection, Security Hub for compliance dashboards) or reuse pre-existing ones via opt-in flags. The reuse paths just imported the existing resources and reported success — they never checked whether the existing services were actually doing their job.\n\n1. **GuardDuty reuse.** If the existing detector was suspended, or set to the slower 6-hour publishing cadence instead of the baseline 15-minute one, or otherwise misconfigured — Hulumi never noticed. The deployment succeeded with a misleadingly-positive `guardDutyDetectorId` output as if the baseline were active.\n2. **Security Hub reuse.** Although the account import was read-only, Hulumi unconditionally created the CIS / NIST `StandardsSubscription` resources with default delete behaviour. Pulumi then treated those subscriptions as its own — a later `pulumi destroy` of the stack would call `BatchDisableStandards`, unsubscribing the account from CIS / NIST compliance monitoring even on accounts that had those subscriptions before Hulumi ever ran.\n\n#### Impact\n\nConsumers using `AccountFoundation`'s reuse mode could:\n\n- ship deployments that appeared to enable a detective baseline but actually weren't (case 1), or\n- accidentally turn off CIS / NIST compliance monitoring on an existing account just by destroying a Hulumi stack (case 2 — no malicious intent needed; a normal stack teardown was enough).\n\n#### Patches\n\nUpgrade to `@hulumi/baseline@1.4.0`.\n\n- GuardDuty reuse now asserts the imported detector is `ENABLED` with `findingPublishingFrequency: FIFTEEN_MINUTES`. Wrong posture fails the deploy at preview time.\n- Security Hub reuse creates the CIS / NIST `StandardsSubscription` resources with `retainOnDelete: true`, so destroying a reused stack no longer unsubscribes the account.\n\nNet-new (non-reuse) deployments are unchanged.\n\n#### Workarounds\n\nDon't reuse pre-existing detective services with `AccountFoundation` before upgrading. If reuse is unavoidable, manually verify detector posture out-of-band.\n\n#### Resources\n\n- [PR #178](https://github.com/kerberosmansour/hulumi/pull/178) (Cluster G); regression tests in\n  `packages/baseline/tests/guardduty-reuse-posture.test.ts` and\n  `packages/baseline/tests/securityhub-reuse-retain.test.ts`.","status":"published","published":"2026-06-10T13:38:59Z","modified":"2026-06-10T13:39:01Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:40:24.856614Z"}],"nvd":[{"id":"CVE-2026-48037","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T19:16:58.897Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:12:32.830533Z"}],"osv":[{"id":"CVE-2026-48037","title":"Hulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture","description":"Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.","status":"published","published":"2026-07-24T18:44:23.652Z","modified":"2026-10-28T02:30:39.425906566Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-cj8g-prcm-mfg5","title":"@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture","description":"**Affected:** `@hulumi/baseline` `\u003c 1.4.0` — **Fixed in:** `1.4.0` — **Severity:** Medium — **CWE-693 (Protection Mechanism Failure)**\n\n#### Summary\n\n`AccountFoundation` can either create AWS detective services (GuardDuty for threat detection, Security Hub for compliance dashboards) or reuse pre-existing ones via opt-in flags. The reuse paths just imported the existing resources and reported success — they never checked whether the existing services were actually doing their job.\n\n1. **GuardDuty reuse.** If the existing detector was suspended, or set to the slower 6-hour publishing cadence instead of the baseline 15-minute one, or otherwise misconfigured — Hulumi never noticed. The deployment succeeded with a misleadingly-positive `guardDutyDetectorId` output as if the baseline were active.\n2. **Security Hub reuse.** Although the account import was read-only, Hulumi unconditionally created the CIS / NIST `StandardsSubscription` resources with default delete behaviour. Pulumi then treated those subscriptions as its own — a later `pulumi destroy` of the stack would call `BatchDisableStandards`, unsubscribing the account from CIS / NIST compliance monitoring even on accounts that had those subscriptions before Hulumi ever ran.\n\n#### Impact\n\nConsumers using `AccountFoundation`'s reuse mode could:\n\n- ship deployments that appeared to enable a detective baseline but actually weren't (case 1), or\n- accidentally turn off CIS / NIST compliance monitoring on an existing account just by destroying a Hulumi stack (case 2 — no malicious intent needed; a normal stack teardown was enough).\n\n#### Patches\n\nUpgrade to `@hulumi/baseline@1.4.0`.\n\n- GuardDuty reuse now asserts the imported detector is `ENABLED` with `findingPublishingFrequency: FIFTEEN_MINUTES`. Wrong posture fails the deploy at preview time.\n- Security Hub reuse creates the CIS / NIST `StandardsSubscription` resources with `retainOnDelete: true`, so destroying a reused stack no longer unsubscribes the account.\n\nNet-new (non-reuse) deployments are unchanged.\n\n#### Workarounds\n\nDon't reuse pre-existing detective services with `AccountFoundation` before upgrading. If reuse is unavoidable, manually verify detector posture out-of-band.\n\n#### Resources\n\n- [PR #178](https://github.com/kerberosmansour/hulumi/pull/178) (Cluster G); regression tests in\n  `packages/baseline/tests/guardduty-reuse-posture.test.ts` and\n  `packages/baseline/tests/securityhub-reuse-retain.test.ts`.","status":"published","published":"2026-06-10T13:38:59Z","modified":"2026-09-10T03:51:08.480492873Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:N","level":"medium"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T15:46:45.28161Z"}]}}