CVE-2026-82857

hulumi versions before v1.3.2 contain an improper privilege management flaw (CWE-269) in the IAM policy attached to its weekly integration, which grants role lifecycle operations on roles named af-e2e-* without sufficient permissions-boundary restrictions. An attacker who can act as the documented integration principal — for example by compromising the credentials or session used by that automation — can create or modify roles matching the af-e2e-* pattern in the sandbox account. Because nothing constrains what those roles may do, the attacker can mint persistent, higher-privilege roles and escalate their access within the sandbox account, with high impact to confidentiality, integrity, and availability per the CVSS 4.0 score of 9.3. Affected users are hulumi deployments relying on the weekly integration IAM policy and the af-e2e-* role namespace in a sandbox account; the size of that population is not publicly documented. There is currently no known exploitation: the flaw is not in CISA KEV, no public proof-of-concept is available, and EPSS assigns only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade hulumi to v1.3.2 or later. As interim mitigation, tighten the weekly integration principal's IAM permissions by scoping role lifecycle actions to only the intended roles and applying permissions boundaries to any af-e2e-* role creation. Also audit af-e2e-* roles in the sandbox account for unexpected or overly privileged roles and trust policies, and rotate the integration principal's credentials if tampering is suspected.