CVE-2026-82860: @hulumi/policies before 1.3.2 Admin Policy Bypass
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@hulumi/policiesto a version that resolves this vulnerability.Fixed in 1.3.2
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the npm package @hulumi/policies at versions earlier than 1.3.2 are affected. The issue concerns the administrator-policy guardrail's handling of inline and attached IAM policy evidence.
What does an attacker need to exploit this issue?
An attacker needs a way to craft admin-equivalent IAM policy paths that are evaluated by the affected policy controls. The vulnerability is rated network-accessible with low attack complexity and requires no privileges or user interaction.
Is the impact limited to a particular type of IAM policy?
No. The affected guardrail does not fully inspect both inline and attached IAM policy evidence, allowing admin-equivalent policy paths to bypass evaluation controls.
How can I determine whether my environment is exposed?
Check whether @hulumi/policies is installed at a version earlier than 1.3.2 and whether its administrator-policy guardrail is used to evaluate IAM policies. Review evaluated policies for admin-equivalent permissions delivered through inline or attached policy paths.