CVE-2026-82861highCWE-284

CVE-2026-82861: high-severity vulnerability in hulumi policies

@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass

Published · Updated

Follow this CVE+ Monitor policies+ Monitor @hulumi/policies

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.4%
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucket configurations.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
hulumi · policies
Related CVEs — hulumi policies

In the same product, most dangerous first.

CVE-2026-82855CRITICAL@hulumi/policies before 1.3.2 Evidence Validation BypassEPSS 0.6%CVE-2026-82860CRITICAL@hulumi/policies before 1.3.2 Admin Policy BypassEPSS 0.5%CVE-2026-82856CRITICAL@hulumi/policies before 1.3.2 OIDC Trust Policy BypassEPSS 0.5%