CVE-2026-82855

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...

EUVD-2026-68443

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...

CVE-2026-82855 @hulumi/policies before 1.3.2 Evidence Validation Bypass

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...

CVE-2026-82855

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass in the Cloudflare and deployment-governance validators. Attackers can submit compliant evidence from unrelated resources—such as different zones, hostnames, origins, or repositories—to suppress violations for unrelated r...

CVE-2026-82855 @hulumi/policies before 1.3.2 Evidence Validation Bypass

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...

PT-2026-83738

Name of the Vulnerable Software and Affected Versions @hulumi/policies versions prior to 1.3.2 Description An issue exists where attackers can submit spoofed SecureBucket parent evidence during policy evaluation. By providing falsified evidence, attackers can bypass security policy checks, which...

GHSA-GFHQ-7499-F3F2 TSPortal: Any user can forge self-deletion requests for any account

Summary Conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. Details Creating a DPA report about another user and leaving the evidence field empty causes that report to look like the reported user self-requested deletion of their data. Ingenuine repo...