hulumi CVE-2026-82857

Requires control of the specific 'documented principal' referenced by hulumi's weekly integration workflow, and a target of role lifecycle operations on roles matching the af-e2e-* prefix within the sandbox AWS account; the enabling defect is the absence of a permissions boundary on those role-creation actions in the integration IAM policy. Limiting factors: the actor must already hold that documented principal's credentials/permissions (not an anonymous outsider despite CVSS PR:N), impact is confined to the sandbox account rather than production, and only versions before v1.3.2 are affected. No user interaction is required.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields a 9.3 Critical score and models a network-reachable, no-privilege, no-interaction attack with high impact to confidentiality, integrity, and availability. However, the description materially qualifies this: exploitation requires 'the documented principal', i.e. the actor must already control a specific, pre-existing IAM identity - this is a form of authentication/authorization that is inconsistent with PR:N, so the real-world barrier is higher than the raw score implies (verify with vendor; my independent assessment uses PR:L). Impact is also bounded to the 'sandbox account' per the description, so subsequent-system impact is correctly N and blast radius is limited to a non-production account unless that account is trusted by others. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automatable exploitation at this time. Net: a legitimately high-severity IAM misconfiguration for anyone running hulumi's integration pipeline, but the 'documented principal' prerequisite and sandbox-only scope make it a targeted insider/lateral-movement risk rather than broadly automatable internet-wide exploitation.

An actor who has obtained the documented IAM principal (for example a leaked CI credential or an over-shared test identity) calls the AWS IAM API to create a new role matching the af-e2e-* naming pattern. Because the weekly integration policy imposes no permissions boundary, the actor attaches broad privileges to that role and leaves it in place as a persistent elevated foothold in the sandbox account. No public POC is referenced, and the attack requires only standard AWS API calls (low complexity).