CVE-2026-82859

Deferred Deferred - Pending Action

SCP Template Bypass in Hulumi IAM Protections

Publication date: 2026-08-31

Last updated on: 2026-09-10

Assigner: VulnCheck

Description

hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-09-10

Generated

2026-09-20

AI Q&A

2026-08-31

EPSS Evaluated

2026-09-15

NVD

CVE-2026-82859

EUVD

EUVD-2026-68447

Affected Vendors & Products

Vendor	Product	Version / Range
hulumi	hulumi	to 1.3.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-82859 is an improper access control vulnerability in hulumi versions before v1.3.2. It involves a deployment SCP template that allows attackers to bypass intended IAM boundary restrictions by exploiting tag-on-create weaknesses in hulumi:iac-role protections during downstream deployments.

Detection Guidance

To detect this vulnerability, check the version of hulumi installed on your system. If it is below v1.3.2, the system is vulnerable. Run the command 'hulumi version' to verify the installed version.

Impact Analysis

This vulnerability allows attackers to bypass IAM restrictions, potentially gaining unauthorized access to cloud resources. It could lead to data breaches, unauthorized modifications, or resource misuse in affected deployments.

Compliance Impact

This vulnerability allows unauthorized access by bypassing IAM boundary restrictions, which could lead to unauthorized data access or modification. For GDPR, this may violate principles of data protection and integrity. For HIPAA, it could compromise protected health information confidentiality. However, the provided text does not explicitly link this vulnerability to specific compliance violations or standards.

Mitigation Strategies

Update hulumi to version v1.3.2 or later to patch the SCP template and IAM boundary weaknesses. Review and update deployment templates and guidance as required by the patch.

Hi! I’m here to help you understand CVE-2026-82859. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70