The vulnerability CVE-2026-48035 in kerberosmansour's hulumi toolkit arises from insufficient technical documentation and configuration errors in the AccountFoundation component. Prior to version 1.4.0, AWS accounts created could have CloudTrail and Config audit logs that were deletable by any principal with S3 delete capabilities, despite expectations of tamper-resistant audit logs. Sandbox-tier deployments had no audit immutability, compounding the risk. The issue has been addressed and patched in hulumi version 1.4.0. The CVSS 4.0 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity.

Affected hulumi versions allow deletion of critical AWS audit logs (CloudTrail and Config) by any principal with S3 delete permissions, violating audit immutability and potentially obscuring malicious activity. This undermines trust in audit logs and can hinder forensic investigations or compliance efforts. Sandbox-tier deployments have no audit immutability, increasing risk. The vulnerability impacts integrity of audit data but does not affect availability or confidentiality directly.

A patch is available and has been released in hulumi version 1.4.0. Users should upgrade to version 1.4.0 or later to remediate this vulnerability. Since hulumi is a cloud service, the vendor manages remediation for the cloud-hosted components; users should verify with the vendor advisory that their environment is updated accordingly. No additional mitigation steps are specified.