31 matches found
CVE-2026-82861
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucke...
CVE-2026-82860
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
CVE-2026-82855
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...
CVE-2026-82856
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...
CVE-2026-82861 @hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucke...
CVE-2026-82861
@hulumi/policies versions before 1.3.2 contain a SecureBucket parent spoof bypass that allows attackers to submit falsified parent evidence during policy evaluation. By providing spoofed evidence, an attacker can cause the validator to miss unsafe bucket configurations, effectively bypassing secu...
EUVD-2026-68449
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucke...
CVE-2026-82861 @hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucke...
CVE-2026-82860
CVE-2026-82860 affects @hulumi/policies versions before 1.3.2 , where the package fails to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. This allows attackers to craft admin-equivalent policy paths that bypass policy evaluation controls, rated CVSS ...
CVE-2026-82860 @hulumi/policies before 1.3.2 Admin Policy Bypass
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
CVE-2026-82860 @hulumi/policies before 1.3.2 Admin Policy Bypass
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
EUVD-2026-68448
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls...
EUVD-2026-68444
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...
CVE-2026-82856 @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...
CVE-2026-82856
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. The root cause is the insufficient handling of operators such as ForAnyValue:StringLike , which attackers can exploit to hide wildcard GitHub Actions OIDC subj...
CVE-2026-82855 @hulumi/policies before 1.3.2 Evidence Validation Bypass
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...
EUVD-2026-68443
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...
CVE-2026-82856 @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails...
CVE-2026-82855
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass in the Cloudflare and deployment-governance validators. Attackers can submit compliant evidence from unrelated resources—such as different zones, hostnames, origins, or repositories—to suppress violations for unrelated r...
CVE-2026-82855 @hulumi/policies before 1.3.2 Evidence Validation Bypass
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origin...