EUVD-2026-68447
GHSA-qwm3-f9wh-qp63
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Bypassing an SCP boundary requires an existing authenticated AWS principal (PR:L); the escape crosses the IAM guardrail into otherwise-restricted scope (S:C) enabling unauthorized access and modification, with no direct availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.
AnalysisAI
IAM boundary bypass in hulumi versions before v1.3.2 stems from a deployment Service Control Policy (SCP) template that permits tag-on-create bypasses of the hulumi:iac-role protections. Operators of downstream AWS deployments provisioned with the weakened template can circumvent intended organizational IAM restrictions, undermining privilege boundaries meant to constrain the IaC deployment role. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an AWS environment where hulumi's deployment SCP template (versions before v1.3.2) has been applied to protect the hulumi:iac-role, and an actor able to issue resource create/tag API calls within that organization. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) yields a 9.3 Critical rating with high confidentiality, integrity, and availability impact and no privileges required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade hulumi to v1.3.2 or later, which corrects the SCP template so tag-on-create can no longer bypass the hulumi:iac-role protections (Vendor-released patch: v1.3.2, per GHSA-86q4-r5j3-ff5c). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudfla
Privilege escalation in the @hulumi/policies npm package before 1.3.2 lets attackers bypass the administrator-policy gua
Privilege escalation in hulumi before v1.3.2 lets an actor holding the documented IAM principal abuse the weekly integra
Security-guardrail bypass in the @hulumi/policies npm library (versions before 1.3.2) allows dangerous AWS IAM configura
Security-check bypass in @hulumi/drift before 1.3.2 allows remote attackers to submit forged execute plans that the orph
Policy evaluation bypass in @hulumi/policies before 1.3.2 permits unauthenticated remote attackers to submit forged Secu
Incomplete CloudTrail event-selector tampering detection in @hulumi/baseline before 1.3.2 (CWE-778: Insufficient Logging
Arbitrary code execution in Hulumi before v1.3.2 is possible through a CWE-426 untrusted search path flaw in the threat-
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today