PT-2026-48475 · Npm+2 · @Hulumi/Policies+1
CVE-2026-48033
·
Published
2026-06-10
·
Updated
2026-07-24
CVSS v4.0
8.4
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
@hulumi/policies versions prior to 1.4.0
Description
Policy packs can be bypassed using a forged Pulumi-URN logical name. The issue occurs because several policy rules check for a trusted substring anywhere within the URN, including the logical name portion which is controlled by the developer. An attacker or a compromised pull request could name a raw resource to include this trusted substring, causing the system to treat the resource as if it were part of a trusted parent component and skip mandatory hardening checks. This affects rules related to
aws:s3:Bucket, github:Repository, cloudflare:Zone, and cloudflare:DnsRecord resources.Recommendations
Upgrade @hulumi/policies to version 1.4.0.
Exploit
Fix
Protection Mechanism Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Hulumi/Policies
Hulumi