The vulnerability in hulumi (kerberosmansour) involves an access control bypass where an attacker can exploit decoy sibling resources to target a different bucket, circumventing intended access restrictions. This flaw affects all versions before 1.4.0. The issue has been addressed and patched in version 1.4.0. The CVSS 4.0 base score is 8.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. No known exploits are reported in the wild.

Successful exploitation allows an attacker with limited privileges to bypass access controls and potentially access or manipulate resources in buckets they should not have access to. This can lead to unauthorized data exposure or modification, impacting confidentiality and integrity of the affected infrastructure components.

Upgrade hulumi to version 1.4.0 or later, where this access control bypass vulnerability has been patched. No other remediation level or temporary fixes are indicated. Users should apply this official fix to prevent exploitation.