PT-2026-48477 · Unknown · @Hulumi/Baseline

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-48035

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions @hulumi/baseline versions prior to 1.4.0

Description Issues in the AccountFoundation component allow the S3 bucket used for CloudTrail and AWS Config audit logs to be modified or deleted, compromising the forensic trail. This occurs through three mechanisms: the startup-hardened tier hard-codes objectLock to false, the logBucketForceDestroy variable can be set to true allowing pulumi destroy to purge audit logs, and the sandbox tier skips Object Lock, server access logging, and the CloudTrail-Lake EventDataStore (an independent immutable mirror).

Recommendations Upgrade to @hulumi/baseline version 1.4.0. As a temporary workaround, replicate audit logs to an out-of-account Object-Locked archive bucket.

Fix

Weakness Enumeration

CWE-1059

Related Identifiers

CVE-2026-48035

GHSA-2MXR-P26X-MJ73

Affected Products

@Hulumi/Baseline

References · 5

• https://osv.dev/vulnerability/GHSA-2mxr-p26x-mj73 · Vendor Advisory
• https://github.com/kerberosmansour/hulumi · Note
• https://github.com/kerberosmansour/hulumi/pull/178 · Note
• https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-2mxr-p26x-mj73 · Note
• https://twitter.com/dailycve/status/2064747257300181500 · Twitter Post