Tag-on-Create Bypass Vulnerability in Hulumi by Kerberos Mansour
CVE-2026-82859

9.3CRITICAL

Key Information:

Vendor

Kerberosmansour

Status
Hulumi
Vendor
CVE Published:
31 August 2026

What is CVE-2026-82859?

Versions of Hulumi before 1.3.2 feature a vulnerable deployment SCP template that allows attackers to bypass tag-on-create protections, thereby circumventing intended IAM boundary restrictions during downstream deployments. This vulnerability can lead to unauthorized access and modification of IAM roles, posing significant security risks to users relying on Hulumi for infrastructure as code.

Affected Version(s)

hulumi 0 < 1.3.2

hulumi 1.3.2

References

https://github.com/kerberosmansour/hulumi/security/adviso...
vendor-advisory
https://www.vulncheck.com/advisories/hulumi-before-1.3.2-...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.