Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: kerberosmansour hulumi 1.3.2 Clear all filters
TI-2026-57166 CVE-2026-82862 · GHSA-ffgq-3pgp-p595

Hulumi before v1.3.2 Helper Script Shadowing via Workspace Files

Priority LOW 39

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to shadow the intended helper script.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00192 Published 2026-08-31 Fixed in 1.3.2 CWE-426
TI-2026-57163 CVE-2026-82859 · GHSA-qwm3-f9wh-qp63

hulumi before v1.3.2 SCP Template Tag-on-Create Bypass

Priority MEDIUM 49

hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00543 Published 2026-08-31 Fixed in 1.3.2 CWE-284
TI-2026-57161 CVE-2026-82857 · GHSA-pjj3-j4q3-9wpg

hulumi before v1.3.2 Privilege Escalation via IAM Policy

Priority MEDIUM 49

hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00512 Published 2026-08-31 Fixed in 1.3.2 CWE-269