An improper access control vulnerability in the hulumi toolkit for Pulumi exposes infrastructure components to unauthorized modifications by authenticated users.

The toolkit suffers from improper access control (CWE-284), which can be exploited by an authenticated user to bypass intended restrictions. This flaw allows unauthorized interaction with cloud and platform infrastructure components that are managed by the tool.

Exploitation of this vulnerability allows for unauthorized access or modification of cloud infrastructure, which poses a severe risk to data integrity and system availability. With a CVSS score of 8.5, the potential for privilege escalation or unauthorized configuration changes makes this a critical security concern for teams managing infrastructure as code.

Immediate Action: Update the @hulumi/policies package to version 1.4.0 or higher.

Proactive Monitoring: Audit logs for unusual infrastructure deployment activities or unauthorized configuration changes initiated by existing user accounts.

Compensating Controls: Implement strict IAM policies and least-privilege access controls on all cloud resources managed by the hulumi toolkit to limit the scope of potential impact.

Public Exploit Available: No (exploit_available: false)

Security teams should verify their current version of the hulumi toolkit and apply the 1.4.0 update as soon as possible. Ensuring that all infrastructure policy components are up to date is essential to maintaining the secure-by-default posture promised by the toolkit.