Summary
@hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket
Affected: @hulumi/policies < 1.4.0, Fixed in: 1.4.0, Severity: High, CWE-284 (Improper Access Control)
HULUMI-H1 forbids raw aws:s3:Bucket outside of Hulumi's SecureBucket component, with one exemption: a raw bucket that's a child of a SecureBucket is allowed because the component is responsible for the hardening. HULUMI-H5 is the defence-in-depth check that closes the H1 exemption, for any raw bucket claiming it, H5 verifies the five hardening sibling resources a real SecureBucket always emits (public-access block, SSE-KMS, ownership controls, versioning, TLS-only bucket policy) are actually present.
The bug: H5 only checked the siblings' types. It never verified that those siblings actually applied to the bucket being exempted. A consumer (or compromised PR) could pair an unhardened raw bucket with five hardening sibling resources whose bucket property pointed at a completely different bucket, and H5 would report no violation while the actual bucket shipped with zero hardened defaults.
Workarounds
None, the exemption itself is the mechanism, so the value-binding check is the only fix.
Resources
Impact
Consumers using HulumiHardeningPack could ship a raw S3 bucket with no public-access block, no SSE-KMS, no ownership controls, no versioning, and no TLS-only bucket policy, while the policy pack reported the stack as compliant.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to @hulumi/[email protected]. The H5 sibling check now requires both (a) the sibling to share the same parent SecureBucket instance via the anchored URN helper from GHSA-2, AND (b) the sibling's bucket property, or, for the bucket policy, its Resource ARN list, to reference the exempted bucket explicitly. Five decoy siblings pointing at a different bucket no longer count.
Frequently Asked Questions
- What is CVE-2026-48034? CVE-2026-48034 is a high-severity security vulnerability in @hulumi/policies (npm), affecting versions < 1.4.0. It is fixed in 1.4.0.
- Which versions of @hulumi/policies are affected by CVE-2026-48034? @hulumi/policies (npm) versions < 1.4.0 is affected.
- Is there a fix for CVE-2026-48034? Yes. CVE-2026-48034 is fixed in 1.4.0. Upgrade to this version or later.
- Is CVE-2026-48034 exploitable, and should I be worried? Whether CVE-2026-48034 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-48034 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-48034? Upgrade
@hulumi/policiesto 1.4.0 or later.