CVE-2026-82857: hulumi Privilege Escalation via Weekly Integration IAM Policy

Overview

A critical privilege-escalation vulnerability has been disclosed in hulumi, affecting the IAM policy attached to its weekly integration test workflow. Tracked as CVE-2026-82857, the flaw allows an attacker with access to the documented principal to perform role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions — enabling creation of persistent, higher-privilege roles in the sandbox AWS account.

This advisory is part of a batch of related critical disclosures across the hulumi package family published the same day — see CVE-2026-82855 and CVE-2026-82856.

Technical Details

How It Works

hulumi's weekly integration test workflow runs under a dedicated IAM policy meant to scope its permissions to managing af-e2e-* prefixed roles within a sandbox AWS account, for automated end-to-end testing. Before 1.3.2, that policy's boundary restrictions on role lifecycle operations (create, update, attach-policy) were insufficiently scoped.

Because the boundary did not adequately constrain what permissions a newly created af-e2e-* role could itself be granted, a principal with access to the documented integration credentials could create a new role under the allowed prefix, attach a broader (higher-privilege) policy to it, and retain that role after the test run completes — establishing a persistent backdoor identity in the sandbox account that exceeds the intended scope of the weekly test automation.

Impact Assessment

Who Is At Risk

Organizations running hulumi (before 1.3.2) with the weekly integration workflow configured against a sandbox AWS account are directly affected. While scoped to a "sandbox" environment by design, sandbox accounts frequently share networking, logging, or CI/CD trust relationships with production infrastructure — meaning a persistent over-privileged role can become a stepping stone rather than a contained risk.

Potential Attack Chain

1. Access to Documented Principal — attacker obtains or already holds credentials for the weekly integration test principal
2. Role Creation — attacker creates a new af-e2e-* role, satisfying the naming boundary
3. Privilege Attachment — attacker attaches a higher-privilege policy than the boundary was intended to allow
4. Persistence — the role remains in the sandbox account after the legitimate test run, functioning as a standing backdoor

Mitigation

Immediate Actions

• Upgrade hulumi to 1.3.2 or later, which resolves the IAM boundary restriction issue on af-e2e-* role lifecycle operations
• Audit the sandbox AWS account for any af-e2e-* roles with policies broader than expected for integration testing, and remove any that weren't created by a legitimate, recent test run
• Rotate credentials for the weekly integration test principal
• Review trust relationships between the sandbox account and any production or shared infrastructure

Detection Opportunities

• Search CloudTrail for CreateRole/AttachRolePolicy/PutRolePolicy calls against af-e2e-* roles outside the scheduled weekly integration window
• Flag any af-e2e-* role whose attached policies exceed the permission set required for end-to-end testing
• Alert on af-e2e-* roles that persist longer than the expected test-run lifecycle

Related Advisories

Part of the same disclosure batch as CVE-2026-82855 (evidence validation bypass), CVE-2026-82856 (OIDC trust policy bypass), and CVE-2026-82858 through CVE-2026-82863 across hulumi, @hulumi/policies, @hulumi/drift, and @hulumi/baseline — all resolved in the 1.3.2 release line. Organizations should upgrade the full hulumi toolchain, not just individual packages.

References

• OffSeq Threat Radar — CVE-2026-82857
• NVD — CVE-2026-82857