CVE-2026-82860
CVE-2026-82860 · @hulumi/policies before 1.3.2 Admin Policy Bypass
This page contains facts from public vulnerability sources. Check the original advisory before updating.
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.
CVSS 9.3 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Stack: node
Affected products and versions
policies
- Versions
- ≥ 0, < 1.3.2: Affected (semver)
- 1.3.2: Not affected (semver)
Update to 1.3.2
@hulumi/policies npm
- Affected ranges
- SEMVER: < 1.3.2
Update to 1.3.2