CVE-2026-82859 — hulumi before v1.3.2 SCP Template Tag-on-Create Bypass
hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary re…
Published: 2026-08-31 · CVSS: 9.3 · CVSS 4.0
hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7