← Database

CVE-2026-82859

CRITICAL CVSS: 9.8 Published: 2026-08-31 Modified: 2026-08-31

Description

hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.

Affected Platforms

Unknown

Weakness Type

CWE-284

References