CVE-2026-82857: hulumi Privilege Escalation Vulnerability

CVE-2026-82857 Overview

CVE-2026-82857 is a privilege escalation vulnerability in hulumi versions before v1.3.2. The flaw resides in the weekly integration Identity and Access Management (IAM) policy, which permits role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. An attacker holding the documented principal can create persistent higher-privilege roles inside the sandbox account. The weakness is categorized under [CWE-269: Improper Privilege Management].

Critical Impact
Attackers with access to the documented principal can create persistent higher-privilege IAM roles in the sandbox account, undermining confidentiality, integrity, and availability of workloads managed by hulumi.

Affected Products

hulumi versions prior to v1.3.2
Weekly integration IAM policy configurations targeting af-e2e-* roles
Sandbox accounts provisioned by vulnerable hulumi releases

Discovery Timeline

2026-08-31 - CVE-2026-82857 published to the National Vulnerability Database (NVD)
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82857

Vulnerability Analysis

The vulnerability stems from insufficient permission boundaries in the weekly integration IAM policy shipped with hulumi. The policy authorizes role lifecycle actions (create, update, attach) against any role matching the af-e2e-* naming pattern. Because the policy does not enforce a permissions boundary or condition constraints on the newly created roles, an attacker can craft roles that grant broader privileges than the integration principal itself should be able to delegate. The result is a classic confused-deputy pattern where a scoped automation identity is leveraged to mint durable, higher-privilege identities in the sandbox account.

Root Cause

The root cause is improper privilege management [CWE-269] in the IAM policy definition. The policy grants iam:CreateRole, iam:PutRolePolicy, and related actions on resources matching af-e2e-* without requiring an iam:PermissionsBoundary condition. This omission allows the integration principal to escalate authority within the sandbox account beyond the intended end-to-end test scope.

Attack Vector

The attack requires network access and the documented principal used by the weekly integration workflow. An attacker who compromises or otherwise assumes that principal invokes IAM APIs to create a new role under the af-e2e-* prefix, attaches high-privilege policies, and then assumes the newly minted role. The resulting role persists after the integration workflow completes, providing a durable foothold in the sandbox account.

No verified proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-35qr-vx94-m5x3 and the VulnCheck Privilege Escalation Advisory for authoritative technical details.

Detection Methods for CVE-2026-82857

Indicators of Compromise

Creation of IAM roles matching the af-e2e-* prefix outside of scheduled weekly integration windows.
New role policies attached to af-e2e-* roles that grant privileges exceeding those held by the integration principal.
sts:AssumeRole events targeting af-e2e-* roles from principals or source IPs not associated with the CI/CD system.

Detection Strategies

Correlate CloudTrail CreateRole, PutRolePolicy, and AttachRolePolicy events on af-e2e-* resources with the identity of the calling principal and workflow context.
Alert when roles are created without an attached PermissionsBoundary, particularly under integration or automation principals.
Baseline the expected cadence of weekly integration runs and flag out-of-band IAM changes.

Monitoring Recommendations

Ingest AWS CloudTrail management events into a centralized analytics platform and retain them for at least 90 days.
Monitor for privilege drift on sandbox accounts, including changes to trust policies of af-e2e-* roles.
Continuously review effective permissions of automation principals against least-privilege baselines.

How to Mitigate CVE-2026-82857

Immediate Actions Required

Upgrade hulumi to version v1.3.2 or later across all environments consuming the weekly integration workflow.
Rotate credentials and session tokens associated with the documented integration principal.
Enumerate existing af-e2e-* roles in sandbox accounts and delete any that were not created by the sanctioned pipeline.

Patch Information

The vendor addressed the issue in hulumi v1.3.2. Consult the GitHub Security Advisory GHSA-35qr-vx94-m5x3 for upgrade guidance and the VulnCheck Privilege Escalation Advisory for additional remediation context.

Workarounds

Attach an explicit iam:PermissionsBoundary condition to the weekly integration IAM policy so newly created af-e2e-* roles cannot exceed the intended scope.
Restrict iam:CreateRole and related actions to a narrow resource ARN pattern and require multi-factor authentication (MFA) for the integration principal where feasible.
Move end-to-end testing into an isolated account with no trust relationships to production identities until the upgrade is completed.

bash

# Configuration example: enforce a permissions boundary on af-e2e-* role creation
# Apply as a condition inside the weekly integration IAM policy
#
# "Condition": {
#   "StringEquals": {
#     "iam:PermissionsBoundary": "arn:aws:iam::<account-id>:policy/af-e2e-boundary"
#   }
# }
#
# Then upgrade hulumi:
npm install hulumi@1.3.2