CVE-2026-82859 Overview
CVE-2026-82859 affects hulumi versions before v1.3.2. The flaw resides in a deployment Service Control Policy (SCP) template that permits tag-on-create bypasses of the hulumi:iac-role protections. Attackers can circumvent intended Identity and Access Management (IAM) boundary restrictions by exploiting the weakened SCP template in downstream deployments. The weakness maps to CWE-284: Improper Access Control and enables high impact to confidentiality, integrity, and availability across affected cloud environments.
Critical Impact
Attackers can bypass IAM boundary restrictions on the hulumi:iac-role by leveraging permissive tag-on-create logic in the SCP template, gaining unintended privileges in downstream deployments.
Affected Products
- hulumi versions prior to v1.3.2
- Downstream deployments consuming the vulnerable SCP template
- Environments relying on hulumi:iac-role for IAM boundary enforcement
Discovery Timeline
- 2026-08-31 - CVE-2026-82859 published to the National Vulnerability Database (NVD)
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82859
Vulnerability Analysis
The vulnerability originates in the deployment SCP template shipped with hulumi. The template governs IAM boundary conditions applied to resources associated with the hulumi:iac-role. Due to a permissive rule set covering resource tagging on creation, an actor can create resources with tags that evade the SCP guardrails. Once the resources exist outside the intended boundary, downstream deployments inherit or interact with them without the expected access restrictions.
The defect is a class of improper access control weakness [CWE-284] in which policy enforcement fails at the object-creation phase. Because IAM boundaries assume the SCP will deny non-conforming operations, a bypass at creation time cascades into privilege drift across the entire deployment pipeline.
Root Cause
The SCP template does not enforce tag validation atomically with resource creation. Actions that combine resource creation with tag assignment can satisfy the tag-based policy check even when the resource itself should be denied. This weakens the hulumi:iac-role protections that downstream stacks depend on.
Attack Vector
Exploitation is network-based and requires no authentication or user interaction. An attacker with access to invoke infrastructure-as-code deployments through the vulnerable hulumi template can craft CreateResource calls that pair the operation with tags satisfying the SCP condition. The malformed request bypasses the policy, resulting in high impact to confidentiality, integrity, and availability of the affected cloud resources.
Technical details are documented in the GitHub Security Advisory GHSA-86q4-r5j3-ff5c and the VulnCheck Advisory. No public proof-of-concept code is available at this time.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-82859
Indicators of Compromise
- Resource creation events where tags are supplied inline with Create* API calls to satisfy SCP conditions on the hulumi:iac-role.
- Unexpected resources assuming or being assumed by the hulumi:iac-role outside approved deployment pipelines.
- CloudTrail or equivalent audit records showing IAM actions that succeeded despite matching SCP deny conditions.
Detection Strategies
- Audit deployed SCP templates for tag-on-create conditions tied to hulumi:iac-role and compare against the fixed v1.3.2 template.
- Correlate infrastructure-as-code (IaC) pipeline logs with cloud audit trails to identify resources created outside sanctioned workflows.
- Baseline resource tag distributions and alert on new tag values that grant SCP exemptions.
Monitoring Recommendations
- Continuously monitor role assumption events for hulumi:iac-role and flag deviations from approved CI/CD identities.
- Enable alerting on SCP evaluation results and drift between intended and effective IAM boundaries.
- Track hulumi CLI and provider versions across environments to identify hosts still running pre-v1.3.2 releases.
How to Mitigate CVE-2026-82859
Immediate Actions Required
- Upgrade hulumi to v1.3.2 or later across all deployment environments.
- Re-deploy the corrected SCP template to every account that previously received the vulnerable version.
- Review recent resource creations under hulumi:iac-role for evidence of tag-based bypass activity.
- Rotate credentials and revoke sessions associated with roles that may have been abused.
Patch Information
The maintainers released hulumi v1.3.2 containing the corrected SCP template. Refer to the GitHub Security Advisory GHSA-86q4-r5j3-ff5c for upgrade instructions and the VulnCheck advisory for additional context.
Workarounds
- Replace the affected SCP template with a policy that denies resource creation and tag assignment as separate, explicit conditions.
- Restrict who may invoke deployments that use the hulumi:iac-role until the patched template is applied.
- Add compensating detective controls that alert on any tag-based SCP exemption used with the hulumi:iac-role.
# Configuration example
# Verify the installed hulumi version and upgrade to the fixed release
hulumi version
hulumi upgrade --version 1.3.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
