Loading...
Skip to main content
GeekWala

CVE-2026-82856 — Vulnerability in @hulumi/policies — CVE Details

CRITICAL

@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators

Published May 21, 2026Updated September 10, 2026Source: osv

Summary

Impact: @hulumi/policies versions before 1.3.2 only checked exact AWS IAM StringLike/StringEquals condition operator keys in G_OIDC_1. Set-qualified operators such as ForAnyValue:StringLike could hide wildcard GitHub Actions OIDC sub conditions from the mandatory guardrail. Patched in 1.3.2: the AWS trust-policy inspector now evaluates set-qualified string operators and rejects unsafe GitHub OIDC sub conditions. Remediation: upgrade @hulumi/policies to 1.3.2 or later.

Advisory Timeline

  • First published May 21, 2026 (144 days ago).
  • Last revised September 10, 2026 — 111 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm
Update @hulumi/policies to 1.3.2 or later
npm install @hulumi/policies@1.3.2

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: npm (1).

PackageEcosystemAffectedFixed In
@hulumi/policies
npm
All versions1.3.2

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-82856?
@hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2026-82856?
CVE-2026-82856 affects @hulumi/policies. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-82856 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-q2f7-m237-v562

Related CVEs

  • CVE-2026-107722
    CRITICAL

    fast-jwt: Incomplete patch of CVE-2026-34950: Non-whitespace key-prefix re-enables RSA→HS256 algorithm confusion

  • CVE-2026-108261
    CRITICAL

    TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

  • CVE-2026-48034
    HIGH

    @hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different bucket

  • CVE-2026-48033
    HIGH

    @hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name

More npm advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies