Executive brief
hulumi is a tool for managing AWS IAM roles and policies in sandbox accounts. The documented weekly integration IAM policy contained overly permissive role lifecycle operations that allowed attackers to create higher-privilege roles, effectively bypassing access controls and gaining persistent elevated permissions in the sandbox environment.
Technical details
The vulnerability is a privilege escalation (CWE-269) in the weekly integration IAM policy template shipped with hulumi versions before v1.3.2. The vulnerable policy allowed unnecessary inline-policy and trust-update permissions on af-e2e-* roles without sufficient boundary or trust restrictions. An attacker with access to a principal documented to use this policy could create persistent higher-privilege roles in the sandbox account. The vulnerability requires the attacker to already have the documented principal in place, making it more of a misconfiguration risk than an unauthenticated remote attack. The fix (v1.3.2) removes the unnecessary inline-policy and trust-update permissions and updates the published guide.
Affected products
- kerberosmansour hulumi before v1.3.2
Timeline
- 2026-05-15: disclosed: GitHub Security Advisory GHSA-35qr-vx94-m5x3 published
- 2026-08-31: advisory: NVD published CVE-2026-82857
- 2026: patched: Version v1.3.2 fixes the vulnerability