Description
hulumi versions before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kerberosmansour | hulumi | < 1.3.2 | 1.3.2 |
References
- GitHub Security Advisory (GHSA-86q4-r5j3-ff5c) vendor-advisory
- VulnCheck Advisory: hulumi before v1.3.2 SCP Template Tag-on-Create Bypass third-party-advisory