CVE-2026-82859
Received Received - Intake

SCP Template Bypass in Hulumi IAM Protections

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82859
EUVD
EUVD-2026-68447

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hulumi hulumi to 1.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82859 is an improper access control vulnerability in hulumi versions before v1.3.2. It involves a deployment SCP template that allows attackers to bypass intended IAM boundary restrictions by exploiting tag-on-create weaknesses in hulumi:iac-role protections during downstream deployments.

Impact Analysis

This vulnerability allows attackers to bypass IAM restrictions, potentially gaining unauthorized access to cloud resources. It could lead to data breaches, unauthorized modifications, or resource misuse in affected deployments.

Mitigation Strategies

Update hulumi to version v1.3.2 or later to patch the SCP template and IAM boundary weaknesses. Review and update deployment templates and guidance as required by the patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82859. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart