Hulumi IAM Boundary Bypass via Weakened SCP Templates

CVE-2026-82859 is a critical vulnerability in hulumi versions before v1.3.2 that undermines Infrastructure-as-Code (IaC) security controls through a flawed Service Control Policy (SCP) template. The vulnerability allows attackers to bypass tag-on-create restrictions designed to enforce IAM boundary protections on the hulumi:iac-role, enabling privilege escalation and lateral movement within AWS environments. This affects organizations using hulumi for IaC deployments who rely on SCPs as a primary defense mechanism. The 9.8 CVSS score reflects the severity: attackers can circumvent organizational guardrails without authentication, directly accessing resources that should be restricted by policy boundaries.

While this CVE currently maps to zero Casky skills and no specific MITRE ATT&CK techniques, practitioners would detect exploitation patterns through behavioral analysis of IAM activities. Detection would focus on policy enforcement gaps—specifically tag-based access control failures and unexpected role assumption operations that violate SCP intent. Casky's extended reasoning capabilities, paired with Claude AI's cross-domain analysis, would correlate suspicious patterns such as: (1) resources created with bypassed tags that should trigger SCP denials, (2) IAM role assumption succeeding when SCPs should block them, and (3) infrastructure deployments circumventing intended security boundaries. Organizations should immediately audit their hulumi deployments, validate SCP template versions, and monitor for unauthorized resource creation patterns that indicate exploitation of this boundary weakness.