critical9.8
CVE-2026-82859
hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections.
Impact
hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.
Affected products
| Product | Affected versions |
|---|---|
| Hulumi | before 1.3.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.