CRITICAL 9.3 NVD

CVE-2026-82856

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForA

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.

References

Published: 2026-08-31 · Source: NVD · Feed updated: 2026-08-31

This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-08-31 via NVD.

Risk Timeline

CVE Disclosed2026-08-31 · -1 days ago

Remediation Resources

Official Advisory

www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-oidc-trust-p

GitHub

github.com/kerberosmansour/hulumi/security/advisories/GHSA-q2f7-m237-v

vulnfeed aggregates 11521 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.