CVE-2026-82855: @hulumi/policies before 1.3.2 Evidence Validation Bypass
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@hulumi/policiesto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using @hulumi/policies versions earlier than 1.3.2 are exposed where Cloudflare or deployment-governance validators rely on submitted evidence to enforce security guardrails.
What does an attacker need to bypass validation?
An attacker needs to submit unrelated evidence that is compliant. The evidence can come from a different zone, hostname, origin, or repository within the same stack.
How can teams determine whether their validation results may be affected?
Review validator evidence associations for Cloudflare and deployment-governance checks. Results may be affected if evidence accepted for a resource originated from a different zone, hostname, origin, or repository in the same stack.