CVE-2026-82861: @hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucket configurations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@hulumi/policiesto a version that resolves this vulnerability.Fixed in 1.3.2 - Compensating control
Until @hulumi/policies is upgraded to 1.3.2 or later, restrict access to policy evaluation inputs so attackers cannot submit spoofed SecureBucket parent evidence during policy evaluation.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker who can submit SecureBucket parent evidence to the policy evaluation process can provide spoofed evidence and bypass the affected security policy checks. No authentication or user interaction is required according to the supplied vector.
What configurations are at risk?
Unsafe bucket configurations are at risk when @hulumi/policies evaluates them using attacker-controlled or untrusted SecureBucket parent evidence. The provided information does not establish whether this condition exists in a default deployment.
What should teams do to remediate it?
Upgrade @hulumi/policies to version 1.3.2 or later. If upgrading cannot happen immediately, avoid accepting untrusted SecureBucket parent evidence in policy evaluation.
How can teams determine whether they are affected?
Identify deployments using the npm package @hulumi/policies at a version earlier than 1.3.2, then review whether their policy evaluation accepts or processes externally supplied SecureBucket parent evidence.