EUVD-2026-68445
GHSA-pjj3-j4q3-9wpg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires the documented principal (PR:L, not PR:N); network IAM API vector with low complexity; primary impact is integrity via unauthorized elevated role creation, with limited confidentiality/availability effect confined to the sandbox account (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.
AnalysisAI
Privilege escalation in hulumi before v1.3.2 lets an actor holding the documented IAM principal abuse the weekly integration IAM policy to perform role lifecycle operations on af-e2e-* roles that lack sufficient permission-boundary restrictions. Because the policy allows role creation without a constraining boundary, the actor can mint persistent, higher-privilege roles inside the sandbox AWS account, converting scoped test access into durable elevated access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires control of the specific 'documented principal' referenced by hulumi's weekly integration workflow, and a target of role lifecycle operations on roles matching the af-e2e-* prefix within the sandbox AWS account; the enabling defect is the absence of a permissions boundary on those role-creation actions in the integration IAM policy. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields a 9.3 Critical score and models a network-reachable, no-privilege, no-interaction attack with high impact to confidentiality, integrity, and availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to hulumi v1.3.2 or later, which corrects the weekly integration IAM policy (fix version confirmed by the advisory as the first non-vulnerable release: Vendor-released patch: v1.3.2). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudfla
Privilege escalation in the @hulumi/policies npm package before 1.3.2 lets attackers bypass the administrator-policy gua
IAM boundary bypass in hulumi versions before v1.3.2 stems from a deployment Service Control Policy (SCP) template that
Security-guardrail bypass in the @hulumi/policies npm library (versions before 1.3.2) allows dangerous AWS IAM configura
Security-check bypass in @hulumi/drift before 1.3.2 allows remote attackers to submit forged execute plans that the orph
Policy evaluation bypass in @hulumi/policies before 1.3.2 permits unauthenticated remote attackers to submit forged Secu
Incomplete CloudTrail event-selector tampering detection in @hulumi/baseline before 1.3.2 (CWE-778: Insufficient Logging
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today