Hulumi IAM Policy Privilege Escalation in Sandbox Roles

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-82857 is a critical privilege escalation vulnerability affecting hulumi versions before v1.3.2 that exploits insufficient boundary restrictions in weekly integration IAM policies. The flaw allows attackers with documented principal access to perform role lifecycle operations on af-e2e-* roles without proper authorization controls, enabling creation of persistent higher-privilege roles within sandbox accounts. This vulnerability is particularly dangerous because it bridges sandbox environments to production-like privilege levels, affecting any organization using vulnerable hulumi versions for IAM management. The 9.8 CVSS score reflects the ease of exploitation and the severe impact of unauthorized privilege escalation in identity and access management systems.

Casky's 224 matched security skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability by mapping to MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would identify detection indicators including: unauthorized role creation operations on af-e2e-* naming patterns, IAM policy modifications that bypass boundary restrictions, unexpected principal activity in sandbox account role management, and anomalous role lifecycle operations outside normal integration windows. The platform's skills would surface suspicious patterns in CloudTrail logs, IAM policy change events, and role assumption chains that deviate from documented integration baselines. By correlating these signals through Claude's reasoning capabilities, security teams gain visibility into both the initial exploitation vector (insufficient boundary checks) and post-exploitation persistence mechanisms (higher-privilege role creation), enabling rapid containment and threat hunting across their IAM infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-82857.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-82857

Casky has 224 skills that investigate the attack patterns behind CVE-2026-82857. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn