A critical flaw reported in hulumi versions before v1.3.2 could allow an attacker holding the documented principal to create persistent higher-privilege roles in the sandbox account through an over-permissive weekly integration IAM policy. The record is still awaiting NVD analysis, so this reflects the vendor and advisory description rather than an independently confirmed exploitation path.
What Is It
CVE-2026-82857 is a privilege escalation vulnerability (CWE-269, Improper Privilege Management) in hulumi, published to NVD on 2026-08-31 by VulnCheck. According to the advisory, the weakness lives in the weekly integration IAM policy, which permits role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. An attacker holding the documented principal could abuse those unbounded lifecycle permissions to create persistent, higher-privilege roles inside the sandbox account.
Why It Matters
The vulnerability carries a CVSS v3.1 base score of 9.8 (CRITICAL): vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS v4.0 secondary score of 9.3 (CRITICAL) is also assigned. That scoring reflects network-reachable attack surface, low attack complexity, and no user interaction, with high impact to confidentiality, integrity, and availability.
Note one inconsistency in the published record: the v3.1 vector asserts PR:N (no privileges required), while the vulnerability description states that exploitation requires an attacker who already holds the documented principal; a precondition that would normally imply some level of prior privilege. Defenders sizing this issue should weigh the description's stated precondition alongside the headline score rather than treating 9.8 as a fully unauthenticated network attack. NVD analysis is still pending, so the vector may be adjusted.
The key risk appears to be persistence, not just momentary access. Based on the advisory's description of unbounded role lifecycle permissions, roles created through this path would be expected to outlive the weekly integration run that spawned them, giving an attacker a durable foothold in the account rather than a transient one. The available records do not document observed post-exploitation behavior, so treat this as an assessment of the mechanism rather than a confirmed exploitation outcome.
What's Vulnerable
- Vendor: kerberosmansour
- Product: hulumi
- Affected versions: all versions from 0 up to (but not including) 1.3.2 (semver)
- Unaffected: 1.3.2 and later; default status for other versions is unaffected
No CPE entries are listed in the NVD record.
Patch Status
Version 1.3.2 is the fixed release. Upgrade any hulumi deployment below v1.3.2 to 1.3.2 or later. Details are documented in the vendor's GitHub security advisory GHSA-35qr-vx94-m5x3 and VulnCheck's advisory.
This CVE does not appear in the CISA Known Exploited Vulnerabilities catalog in the supplied data; there is no KEV confirmation of active exploitation and no associated federal remediation deadline or required action. NVD lists the record as Received, meaning analysis is still pending and details may change.
Sources
- NVD, CVE-2026-82857: https://nvd.nist.gov/vuln/detail/CVE-2026-82857
- GitHub Security Advisory GHSA-35qr-vx94-m5x3: https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-35qr-vx94-m5x3
- VulnCheck Advisory; hulumi before 1.3.2 privilege escalation via IAM policy: https://www.vulncheck.com/advisories/hulumi-before-1.3.2-privilege-escalation-via-iam-policy