Security advisories

medium2026-06-10

@hulumi/baseline: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture

GHSA-cj8g-prcm-mfg5 · CVE-2026-48037

high2026-06-10

@hulumi/drift: Drift classifier fails open on adapter errors and over-promotes Mixed verdicts

GHSA-32g3-35g9-wc9g · CVE-2026-48036

high2026-06-10

@hulumi/baseline: AccountFoundation audit-delivery S3 bucket could be silently weakened

GHSA-2mxr-p26x-mj73 · CVE-2026-48035

high2026-06-10

@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

GHSA-9vc9-4jv3-rf86 · CVE-2026-48034

high2026-06-10

@hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name

GHSA-rhgj-6g2c-frmm · CVE-2026-48033

high2026-06-10

@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers

GHSA-g759-4pxw-6692 · CVE-2026-48032

high2026-05-21

@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails

GHSA-59f3-7227-wmh4

critical2026-05-21

@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators

GHSA-q2f7-m237-v562

high2026-05-21

@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies

GHSA-4xrh-5m3m-328w

high2026-05-21

@hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass

GHSA-g43v-9x7q-83pq

high2026-05-21

@hulumi/drift: Orphan reconciler accepted externally supplied execute plans

GHSA-2ffm-hxrq-qqmm

medium2026-05-21

@hulumi/baseline: CloudTrail selector tampering events were not fully detected

GHSA-gfp8-mp24-5vxg