critical9.8
CVE-2026-82857
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e…
Impact
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.
Affected products
| Product | Affected versions |
|---|---|
| Hulumi | before 1.3.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.