CVE-2026-82857: falha crítica em kerberosmansour hulumi
hulumi before v1.3.2 Privilege Escalation via IAM Policy
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.5%
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
kerberosmansour · hulumiCVEs relacionadas — kerberosmansour hulumi
No mesmo produto, das mais perigosas para as menos.
CVE-2026-82859CRITICALhulumi before v1.3.2 SCP Template Tag-on-Create BypassEPSS 0.5%CVE-2026-48032HIGHHulumi: IAM-role policy checks bypassed when the role trusts multiple OIDC providersEPSS 0.5%CVE-2026-48036HIGHHulumi: Drift classifier fails open on adapter errors and over-promotes Mixed verdictsEPSS 0.5%CVE-2026-48033HIGHHulumi: Policy packs bypassed by a forged Pulumi-URN logical nameEPSS 0.5%CVE-2026-48037MEDIUMHulumi: AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub postureEPSS 0.5%CVE-2026-48035HIGHHulumi: AccountFoundation audit-delivery S3 bucket could be silently weakenedEPSS 0.5%