CVE-2026-82856: @hulumi/policies before 1.3.2 OIDC Trust Policy Bypass
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@hulumi/policiesto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
Which environments are exposed?
Environments using @hulumi/policies to apply security guardrails to GitHub OIDC trust policies are exposed if they use a version earlier than 1.3.2. The issue concerns validation of AWS IAM set-qualified condition operators in those policies.
What does an attacker need to bypass the guardrails?
The bypass relies on using a ForAnyValue:StringLike condition operator to conceal wildcard GitHub Actions OIDC subject conditions from the policy validation guardrails.
How can I determine whether I need to remediate?
Check the installed @hulumi/policies version. Versions before 1.3.2 are affected; upgrade to 1.3.2 or later.