Hulumi npm Package Privilege Escalation Vulnerability: CVE-2026-82857
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- hulumi (npm)
- Affected versions
- >= v1.3.1, <= v1.3.1 or >= v1.3.0, <= v1.3.0 or >= v1.2.0, <= v1.2.0
- Patched version
- v1.3.2
Hulumi npm package versions before v1.3.2 contain a critical privilege escalation vulnerability. Users of affected versions are advised to upgrade immediately.
What happened
Hulumi versions before v1.3.2 have been identified to contain a critical privilege escalation vulnerability. This vulnerability, tracked as CVE-2026-82857, is located in the weekly integration IAM policy. It allows unauthorized role lifecycle operations on af-e2e-* roles, which can lead to the creation of persistent higher-privilege roles in the sandbox account. The vulnerability was first flagged on 2026-08-31 and confirmed shortly thereafter.
The affected versions include all releases from v1.3.1 and earlier, specifically v1.3.1, v1.3.0, and v1.2.0. The vulnerability has a CVSS score of 9.8, indicating its critical severity. Although it has not been exploited in the wild, the potential impact warrants immediate attention and action from users of the Hulumi package.
What to do about it
- Upgrade to Hulumi v1.3.2 or later to mitigate the privilege escalation vulnerability.
- Review your IAM policies for any af-e2e-* roles and ensure they have appropriate boundary restrictions.
- Monitor your sandbox account for any unauthorized role creations or modifications.
- Consult the NVD entries for CVE-2026-82855, CVE-2026-82856, CVE-2026-82857, CVE-2026-82858, CVE-2026-82859, and CVE-2026-82860 for the latest information and updates.
How 0Day would have caught this
hulumi is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Hulumi npm package versions v1.3.1, v1.3.0, or v1.2.0.
What should I do right now?
Upgrade to Hulumi v1.3.2 or later immediately.
Has this vulnerability been exploited in the wild?
No, this vulnerability has not been exploited in the wild according to the provided data.
Where can I find more information about this vulnerability?
Consult the NVD entries for CVE-2026-82855, CVE-2026-82856, CVE-2026-82857, CVE-2026-82858, CVE-2026-82859, and CVE-2026-82860 for more detailed information.