Vulnerability · Published Aug 31, 2026 · Assigned by VulnCheck

CVE-2026-82856@hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

Critical 9.8

In plain English

A critical-severity improper access control in policies from hulumi. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 56.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@hulumi/policies	1.3.2	GHSA-q2f7-m237-v562

Affected products (as reported)

Vendor	Product	Versions
hulumi	policies	0 – before 1.3.2

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory (GHSA-q2f7-m237-v562) vendor-advisory
VulnCheck Advisory: @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass third-party-advisory