CVE-2026-82856
CVE-2026-82856 · @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.
CVSS 9.3 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
policies
- Versions
- ≥ 0, < 1.3.2: Affected (semver)
- 1.3.2: Not affected (semver)
Update to 1.3.2
@hulumi/policies npm
- Affected ranges
- SEMVER: < 1.3.2
Update to 1.3.2