Security readout for executives and security teams
Plain-English summary
A hulumi IAM policy can let an attacker using the documented principal create persistent, more-privileged roles in a sandbox AWS account. This could undermine confidentiality, integrity, and availability within that account. The issue affects releases before v1.3.2 and is rated critical, but the supplied sources do not report active exploitation.
Executive priority
Treat as an urgent remediation for environments using the affected integration policy. Prioritize version inventory, upgrade, IAM review, and investigation for unexpected roles. Urgency is driven by potential persistent privilege escalation and critical severity, not confirmed exploitation.
Technical view
The weekly integration IAM policy permits lifecycle operations on af-e2e-* roles without adequate boundary restrictions. This creates a CWE-269 privilege-management failure that can enable persistent higher-privilege roles. The supplied CVSS 3.1 score is 9.8. The bundle identifies versions before v1.3.2 as vulnerable, although its structured affected-version data is internally ambiguous.
Likely exposure
Exposure is likely limited to deployments using hulumi before v1.3.2 where the weekly integration policy and documented principal exist in the sandbox account. The bundle does not establish exposure in other accounts, policies, principals, or products.
Exploitation context
The described attack requires access through the documented principal and abuses permitted IAM role lifecycle operations. No KEV listing or cited evidence of active exploitation is provided. The CVSS vector reports no privileges required, but that conflicts with the narrative's principal requirement and should be verified.
Researcher notes
The source bundle contains inconsistent version semantics: its narrative says versions before v1.3.2, while structured data lists "0" and "1.3.2" with default status unaffected. It also pairs a PR:N vector with a documented-principal prerequisite. Consult the linked CVE and vendor advisory before final scoping.
Mitigation direction
- Upgrade hulumi to v1.3.2 or later.
- Review vendor guidance for the corrected weekly integration IAM policy.
- Restrict af-e2e-* role lifecycle permissions with appropriate IAM boundaries.
- Remove unauthorized roles and revoke unnecessary principal access.
- Monitor IAM changes for unexpected role creation or policy modification.
Validation and detection
- Inventory hulumi versions and flag releases earlier than v1.3.2.
- Identify sandbox accounts containing the weekly integration IAM policy.
- Review permissions affecting lifecycle operations on af-e2e-* roles.
- Confirm required permission boundaries are enforced after remediation.
- Audit role history for unexpected creation, modification, or persistence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-82857 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-35qr-vx94-m5x3)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: hulumi before v1.3.2 Privilege Escalation via IAM PolicyCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
CWE mapping pending import
This CVE carries a CWE mapping that will resolve to a full Glexia CWE intelligence page after the official CWE import is complete.