CyberRota Analysis
AI-GeneratedHulumi versions prior to v1.3.2 are susceptible to a critical privilege escalation vulnerability that permits unauthorized role lifecycle operations on af-e2e-* roles due to inadequate boundary restrictions in the weekly integration IAM policy. This flaw enables attackers with the specified principal to establish persistent higher-privilege roles within the sandbox account, potentially compromising security. Organizations using affected versions should prioritize immediate updates to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
hulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that allows role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.