A critical (CVSS 9.8) access control flaw in hulumi versions before v1.3.2 could allow intended IAM boundary restrictions to be bypassed via a weakened deployment SCP template.
What Is It
CVE-2026-82859 is an improper access control vulnerability (CWE-284) affecting the infrastructure-as-code tool hulumi, published by kerberosmansour. Versions before v1.3.2 ship a deployment Service Control Policy (SCP) template that permits tag-on-create bypasses for hulumi:iac-role protections. Where a downstream deployment uses the vulnerable template, the resulting policy would not reliably enforce the IAM boundary it was intended to establish, which in principle allows that boundary to be escaped. No public proof-of-concept or exploitation technique has been published in the advisory material, and the conditions required to reach the weakness in a live environment are not described there.
The CVE was assigned and disclosed via VulnCheck, and was published on 2026-08-31.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. A CVSS 4.0 secondary score of 9.3 (CRITICAL) was also assigned.
That vector describes a worst-case exposure profile: network-reachable, low attack complexity, no privileges required, and no user interaction, with high impact to confidentiality, integrity, and availability. It is worth noting that this scoring sits uneasily with the flaw as described. The weakness resides in a policy template, and the described impact depends on that template being consumed by a downstream deployment and on an actor holding some position within the affected AWS environment; conditions that are not obviously consistent with AV:N/PR:N/UI:N. The unchanged-scope rating (S:U) is likewise difficult to square with an issue whose entire significance is that it undermines a control governing other roles' permissions. Operators should treat the 9.8 as an upper bound reflecting worst-case assumptions rather than as a measured description of the attack path, and prioritize based on whether their own deployments actually inherited the template.
Because the flaw sits in a policy template that guards IAM role boundaries, a successful bypass would undermine the control that is supposed to constrain what deployed roles can do.
What's Vulnerable
- Vendor: kerberosmansour
- Product: hulumi
- Affected: all versions from 0 up to (but not including) 1.3.2 (semver)
- Not affected: 1.3.2 and later
The default status for versions outside that range is unaffected. No CPE entries were listed in the NVD record.
Patch Status
Version 1.3.2 is designated unaffected, making an upgrade to v1.3.2 or later the fix. Operators running hulumi should upgrade and then review downstream deployments that inherited the vulnerable SCP template, since previously generated policies may still carry the weakened protection.
The NVD record is in "Received" status, meaning NVD analysis was still pending as of publication.
As of publication, a search of the CISA Known Exploited Vulnerabilities catalog returned no entry for CVE-2026-82859, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline. KEV is updated continuously; readers should confirm current status against the catalog directly, linked below.
Sources
- NVD, CVE-2026-82859: https://nvd.nist.gov/vuln/detail/CVE-2026-82859
- GitHub Security Advisory GHSA-86q4-r5j3-ff5c: https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-86q4-r5j3-ff5c
- VulnCheck Advisory: https://www.vulncheck.com/advisories/hulumi-before-1.3.2-scp-template-tag-on-create-bypass
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog