SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-48037

MEDIUM · CVSS 6.3 EPSS 0.26% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-24 · Last synced 2026-08-23

CyberRota Analysis

AI-Generated

Prior to version 1.4.0, the Hulumi open-source toolkit contains a vulnerability that allows AccountFoundation reuse paths to inadvertently downgrade the security posture of AWS GuardDuty and Security Hub. This could lead to reduced threat detection and response capabilities, potentially exposing cloud environments to increased risk. Organizations utilizing Hulumi for cloud infrastructure management should prioritize upgrading to version 1.4.0 to mitigate this risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-48037
Severity
MEDIUM
CVSS
6.3
EPSS
0.26%

Original NVD Description

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0.