What is CVE-2026-48032?
CVE-2026-48032 affects the Hulumi open-source cloud infrastructure toolkit before version 1.4.0, where IAM role policy checks can be bypassed if the role trusts multiple OIDC providers. This allows unauthorized policy evasion. Upgrade to version 1.4.0 to apply the fix.
Azərbaycanca: CVE-2026-48032 Hulumi açıq mənbəli bulud infrastruktur alətində aşkarlanıb, versiya 1.4.0-dan əvvəl. Zərərli şəxs bir neçə OIDC provayderə etibar edən IAM rol siyasəti yoxlamalarından yayına bilər. Patch versiya 1.4.0-a yüksəltməklə problemi aradan qaldırmaq olar.
FAQ2
How can I protect against the CVE-2026-48032 vulnerability in Hulumi?
The vulnerability is fixed in version 1.4.0, so you should upgrade Hulumi to version 1.4.0 or later.
Under what conditions can CVE-2026-48032 be exploited?
If the IAM role policy trusts multiple OIDC providers, an attacker can bypass the role policy checks.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.