@hulumi/policies CVE-2026-82855

Exploitation requires that the target organization uses @hulumi/policies (< 1.3.2) to enforce the affected Cloudflare or deployment-governance validators, and that the attacker can submit evidence into the same stack's governance process. The specific trigger is supplying compliant evidence tied to a different protected resource - a different Cloudflare zone, hostname, origin, or repository - than the one being evaluated; the vulnerable stack-wide shortcut then accepts it for the unrelated resource. Limiting factors: the attacker must be positioned to inject evidence into the deployment pipeline (typically an authenticated CI/CD or developer context, not an anonymous internet user), the affected validator types must be in use, and there must be at least one genuinely compliant resource in the stack whose evidence can be borrowed. It does not require user interaction beyond the normal evidence-submission flow.

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) rates this critical with full CIA impact and no privileges. That rating appears inflated for a governance-bypass flaw: the concrete effect is that non-compliant resources evade policy enforcement, which is fundamentally an integrity/authorization failure rather than direct disclosure or destruction of data or systems. Realistically, exploitation requires the ability to submit evidence into the stack's governance flow - typically an authenticated CI/CD or deployment actor - so PR:N is questionable and PR:L is more defensible. There is no CISA KEV listing and no known public POC, and EPSS is not provided, so there is no signal of active or automated exploitation. Net: treat this as a meaningful integrity/guardrail-weakening issue for organizations that actually rely on @hulumi/policies to gate Cloudflare and deployment governance, but the headline 9.3 overstates real-world blast radius given the niche footprint and pipeline-access prerequisite. Conflict to verify with the vendor: the CVSS claims PR:N and VC/VI/VA:H, while the description implies an insider-to-pipeline authorization bypass with primarily integrity impact.

An actor with access to a stack's deployment/governance flow needs to ship a Cloudflare zone or repository that would fail a guardrail. Instead of remediating, they submit compliant evidence drawn from a different, already-conforming zone or repo in the same stack; the pre-1.3.2 validator accepts the stack-wide evidence and suppresses the violation, allowing the non-compliant resource to deploy. No public exploit code is known, and the attack requires the ability to submit evidence within the stack rather than purely remote unauthenticated access.