CVE-2026-82855criticalCWE-693

CVE-2026-82855: critical vulnerability in hulumi policies

@hulumi/policies before 1.3.2 Evidence Validation Bypass

Published · Updated

Follow this CVE+ Monitor policies+ Monitor @hulumi/policies

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.6%
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
hulumi · policies
Related CVEs — hulumi policies

In the same product, most dangerous first.

CVE-2026-82860CRITICAL@hulumi/policies before 1.3.2 Admin Policy BypassEPSS 0.5%CVE-2026-82856CRITICAL@hulumi/policies before 1.3.2 OIDC Trust Policy BypassEPSS 0.5%CVE-2026-82861HIGH@hulumi/policies before 1.3.2 SecureBucket Parent Spoof BypassEPSS 0.4%