CVE-2026-82859: Improper Access Control in kerberosmansour hulumi

CVE-2026-82859 is an improper access control vulnerability in kerberosmansour hulumi prior to version 1.3.2. The issue stems from a deployment SCP template that allows tag-on-create bypasses of hulumi:iac-role protections. This enables attackers to bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments. The vulnerability is rated critical with a CVSS 4.0 score of 9.3, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to bypass IAM boundary restrictions intended to protect resources, potentially leading to unauthorized access and control over affected deployments. The critical CVSS score reflects a high impact on confidentiality, integrity, and availability without requiring privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented. Users should monitor vendor communications for updates and avoid deploying vulnerable versions in sensitive environments until a fix is available.