The vulnerability identified as CVE-2026-48032 affects hulumi, an open-source toolkit for secure cloud and platform infrastructure components. The flaw involves an incorrect comparison in IAM-role policy checks that allows bypassing these checks if the role trusts multiple OpenID Connect (OIDC) providers. This security weakness is classified under CWE-697 (Incorrect Comparison). The issue is resolved in hulumi version 1.4.0, which patches the bypass condition.

An attacker can bypass IAM-role policy checks when multiple OIDC providers are trusted by a role, potentially gaining unauthorized access or privileges. The CVSS 4.0 score of 8.3 indicates a high impact with network attack vector, low attack complexity, no user interaction, and partial attack and vulnerability scope. This could lead to privilege escalation or unauthorized resource access within affected deployments.

Upgrade hulumi to version 1.4.0 or later, where the IAM-role policy check bypass vulnerability has been patched. No other official remediation or temporary fixes are documented. Users should apply this update promptly to mitigate the risk.