CVE-2026-82857— hulumi before v1.3.2 Privilege Escalation via IAM Policy
Quick assessment
Affected
kerberosmansour hulumi
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 v1.3.2 之前的 hulumi 版本中，其每周集成的 IAM 策略存在一个权限提升漏洞。该策略对 af-e2e-* 角色执行角色生命周期操作时，缺乏足够的边界限制。拥有文档中所述主体（principal）权限的攻击者，能够在沙箱账户中创建持久化的更高权限角色。
Possible ATT&CK Techniques 1 AI
T1098 · Account Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82857
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
hulumi before v1.3.2 Privilege Escalation via IAM Policy
Source: CVE Program / CVE List V5
Vulnerability Description
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| kerberosmansour | hulumi | 0 ~ 1.3.2 | - |
|
II. Public POCs for CVE-2026-82857
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82857
请登录查看更多情报信息。
Other References for CVE-2026-82857 (2)
-
-
🔗 hulumi before v1.3.2 Privilege Escalation via IAM Policy | Advisories | VulnCheck third-party-advisory
Same Patch Batch · kerberosmansour · 2026-08-31 · 3 CVEs total
| CVE-2026-82859 | 9.8 CRITICAL | hulumi before v1.3.2 SCP Template Tag-on-Create Bypass |
| CVE-2026-82862 | 8.4 HIGH | Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files |
IV. Related Vulnerabilities
Same product: hulumi
-
CVE-2026-82862
Hulumi before v1.3.2 Helper Script Shadowing via Workspace F -
CVE-2026-82859
hulumi before v1.3.2 SCP Template Tag-on-Create Bypass -
CVE-2026-48037
Hulumi: AccountFoundation reuse paths silently downgrade Gua -
CVE-2026-48036
Hulumi: Drift classifier fails open on adapter errors and ov -
CVE-2026-48035
Hulumi: AccountFoundation audit-delivery S3 bucket could be
Same vendor: kerberosmansour
-
CVE-2026-82862
Hulumi before v1.3.2 Helper Script Shadowing via Workspace F -
CVE-2026-82859
hulumi before v1.3.2 SCP Template Tag-on-Create Bypass -
CVE-2026-48037
Hulumi: AccountFoundation reuse paths silently downgrade Gua -
CVE-2026-48036
Hulumi: Drift classifier fails open on adapter errors and ov -
CVE-2026-48035
Hulumi: AccountFoundation audit-delivery S3 bucket could be
Same weakness: CWE-269
-
CVE-2026-82807
ieungSoft Ultra RAMDisk Pro Kernel Driver URDSCSI.sys privil -
CVE-2026-82671
IObit Unlocker IRP_MJ_DEVICE_CONTROL IObitUnlocker.sys ZwTer -
CVE-2026-82670
IObit Uninstaller IOCTL IUForceDelete.sys IRP_MJ_DEVICE_CONT -
CVE-2026-82860
@hulumi/policies before 1.3.2 Admin Policy Bypass -
CVE-2026-82628
Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_1150
V. Comments for CVE-2026-82857
No comments yet