CVE-2026-82859

hulumi versions before v1.3.2 ship a deployment service control policy (SCP) template that fails to properly restrict creation of resources carrying the protected hulumi:iac-role tag, permitting a tag-on-create bypass of the intended protections (CWE-284, improper access control). The flaw is triggered in downstream deployments that applied the supplied SCP template: principals can create resources tagged with hulumi:iac-role even where the policy was meant to limit or gate that action. As a result, an attacker can bypass the intended IAM boundary restrictions the SCP was designed to enforce, weakening the access-control perimeter around the deployment environment. Any organization running hulumi before v1.3.2 that deployed the flawed SCP template in its cloud organization or accounts is affected. Exploitation is not currently observed: there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only about a 0.3% probability of exploitation within 30 days (23rd percentile).

What to do: Upgrade hulumi to v1.3.2 or later and replace the weakened SCP template in all downstream deployments with the corrected policy. Audit resources created while the flawed template was active, specifically looking for tag-on-create actions that attached the hulumi:iac-role tag from unintended principals, and verify the deployed SCP now denies or restricts such creations as intended.