hulumi policies

4 known vulnerabilities in hulumi policies, 3 critical, with patch priority, exploit likelihood and the news covering them.

Latest vulnerabilities

  • CVE-2026-82861 CVSS 8.7 high @hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket…
  • CVE-2026-82860 CVSS 9.3 critical @hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy…
  • CVE-2026-82856 CVSS 9.3 critical @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies…
  • CVE-2026-82855 CVSS 9.3 critical @hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance…