hulumi/policies CVE-2026-82856

Exploitation requires that @hulumi/policies (version < 1.3.2) is actually used to inspect AWS IAM GitHub OIDC trust policies, and that an attacker can introduce or influence a trust policy that expresses the GitHub Actions OIDC 'sub' condition using a set-qualified operator such as ForAnyValue:StringLike (or ForAllValues:) with a wildcard value. The condition that triggers the flaw is specifically the use of set-qualified StringLike/StringEquals operators, which the pre-1.3.2 inspector did not evaluate. Limiting factors: the library must be the (or a) enforcement point; the malicious/overbroad policy must be accepted into the environment; and independent AWS-side controls or manual review, if present, can catch the wildcard even when this library does not. The flaw does not directly compromise the library host - impact is realized in AWS.

The signals are mixed and should be read carefully. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) rates this Critical (9.3), but that vector describes worst-case downstream AWS compromise rather than a direct network exploit of the library itself - the library is a static/CI-time inspector, so 'attack' means slipping a crafted IAM trust policy past it, after which the actual privilege gain occurs in AWS. There is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept identified, so this is not evidence of active or widespread exploitation; it is a serious latent misconfiguration-detection gap. Real-world priority depends heavily on how the library is used: teams that rely on @hulumi/policies as their sole guardrail for GitHub-OIDC-to-AWS trust policies should treat it as urgent, because a bypassed check can silently authorize any GitHub repository/branch to assume a role, whereas teams with layered controls (manual review, AWS-side condition enforcement, IAM Access Analyzer) face lower effective risk. Net: high-impact-if-relevant but exploitation is gated on the specific deployment, so it is a fix-promptly issue for users of this package rather than an internet-wide emergency.

An engineer (or a malicious contributor) submits an infrastructure-as-code change adding an AWS role whose GitHub OIDC trust policy uses ForAnyValue:StringLike to set the 'sub' claim to a wildcard; the pre-merge @hulumi/policies guardrail (pre-1.3.2) fails to recognize the set-qualified operator and approves it. Once merged, workflows from unintended repositories or branches can assume that AWS role via OIDC. No public exploit code is identified at time of analysis; exploitation requires the crafted policy to be introduced into a pipeline that trusts this library as its guardrail.