CVE-2026-82857: Improper Privilege Management in kerberosmansour hulumi

CVE-2026-82857 is a privilege escalation vulnerability affecting kerberosmansour hulumi versions prior to v1.3.2. The issue arises from improper privilege management in the weekly integration IAM policy, which permits role lifecycle operations on af-e2e-* roles without adequate boundary restrictions. Attackers possessing the documented principal can exploit this to create persistent roles with elevated privileges within the sandbox account, potentially compromising the security boundary.

An attacker with the documented principal can escalate privileges by creating persistent higher-privilege roles in the sandbox account. This could lead to unauthorized access and control within the affected environment. The CVSS 4.0 score of 9.3 indicates a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor vendor communications for updates and consider restricting access to the documented principal until a fix is available.