Description

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T09:17:05.920Z",
  "pubdate": "2026-08-31T09:17:05.920Z",
  "executiveSummary": "Hulumi versions prior to v1.3.2 are susceptible to a critical privilege escalation vulnerability within the weekly integration IAM policy.\nThe vulnerability stems from insufficient boundary restrictions on af-e2e-* roles, enabling unauthorized role lifecycle operations.\nAn attacker possessing the documented principal permissions can leverage this misconfiguration to instantiate persistent, elevated-privilege roles within the sandbox environment.\nThis represents a significant security risk, as it allows for unauthorized persistence and potential lateral movement or resource compromise by entities that should be restricted to limited operational scope.\nSuccessful exploitation requires the attacker to hold specific, documented principal credentials, granting them the ability to manipulate role lifecycle states beyond their intended security perimeter.",
  "technicalDetails": "The root cause of this vulnerability lies in an overly permissive IAM policy configuration associated with the weekly integration process in Hulumi versions before v1.3.2.\nSpecifically, the policy fails to enforce adequate permission boundaries for roles prefixed with 'af-e2e-'.\nIn AWS or similar identity management environments, IAM policies are intended to restrict the actions a principal can perform; however, the lack of resource-level scoping allows a principal with write access to IAM role resources to exceed their administrative authorization.\nThe attack flow commences when an authenticated attacker, operating under a principal account authorized to interact with the weekly integration workflow, targets the 'af-e2e-*' role namespace.\nBecause the underlying policy lacks explicit conditions or identity-based boundaries (such as Permissions Boundaries), the attacker can invoke APIs responsible for role creation and policy attachment.\nBy systematically creating new roles—or modifying existing ones—that inherit elevated privileges or trust relationships, the attacker bypasses the principle of least privilege.\nThese roles can be configured with broad service access or administrative policies, effectively granting the attacker a persistent foothold in the sandbox environment that persists even after the initial integration session terminates.\nThe impact is characterized by full subversion of the intended IAM delegation model, where the attacker transforms limited integration-level access into long-term, high-privilege administrative access within the sandbox account.\nThis post-exploitation state allows for data exfiltration, persistent backdoors, and the potential for secondary attacks on other cloud-native resources managed by the sandbox identity provider.\nAuthentication is a prerequisite for exploitation, as the attacker must leverage the documented principal; however, no further exploit complexity is required once the initial session is established."
}