Policies
Monthly
Policy evaluation bypass in @hulumi/policies before 1.3.2 permits unauthenticated remote attackers to submit forged SecureBucket parent evidence, causing the validator to incorrectly classify unsafe bucket configurations as compliant and bypass associated security controls. The flaw (internally tracked as HULUMI-H1) exists because the validator did not correlate submitted evidence against the expected component-to-resource relationship, allowing fabricated evidence to satisfy policy checks. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 1.3.2.
Privilege escalation in the @hulumi/policies npm package before 1.3.2 lets attackers bypass the administrator-policy guardrail (CIS 1.16) by crafting admin-equivalent inline or attached IAM policy shapes that the validator failed to fully inspect. Any environment relying on this library to detect over-privileged IAM policies could silently pass admin-equivalent access as compliant. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Security-guardrail bypass in the @hulumi/policies npm library (versions before 1.3.2) allows dangerous AWS IAM configurations to pass automated policy inspection. The G_OIDC_1 trust-policy inspector only matched exact StringLike/StringEquals condition operators, so set-qualified operators like ForAnyValue:StringLike could smuggle wildcard GitHub Actions OIDC 'sub' conditions past the mandatory check, letting an overly permissive AWS role assumption go undetected. Reported by VulnCheck; no public exploit is identified at time of analysis, and it is not on CISA KEV. The CVSS 4.0 score is 9.3 (Critical).
Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudflare and deployment-governance policy violations by supplying unrelated but compliant-looking evidence. Because validators accepted stack-wide evidence shortcuts rather than correlating proof to the specific protected resource, evidence from one zone, hostname, origin, or repository could silence guardrails for a completely different resource in the same stack. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed by correlating evidence to the protected resource in 1.3.2.
Policy evaluation bypass in @hulumi/policies before 1.3.2 permits unauthenticated remote attackers to submit forged SecureBucket parent evidence, causing the validator to incorrectly classify unsafe bucket configurations as compliant and bypass associated security controls. The flaw (internally tracked as HULUMI-H1) exists because the validator did not correlate submitted evidence against the expected component-to-resource relationship, allowing fabricated evidence to satisfy policy checks. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available in version 1.3.2.
Privilege escalation in the @hulumi/policies npm package before 1.3.2 lets attackers bypass the administrator-policy guardrail (CIS 1.16) by crafting admin-equivalent inline or attached IAM policy shapes that the validator failed to fully inspect. Any environment relying on this library to detect over-privileged IAM policies could silently pass admin-equivalent access as compliant. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Security-guardrail bypass in the @hulumi/policies npm library (versions before 1.3.2) allows dangerous AWS IAM configurations to pass automated policy inspection. The G_OIDC_1 trust-policy inspector only matched exact StringLike/StringEquals condition operators, so set-qualified operators like ForAnyValue:StringLike could smuggle wildcard GitHub Actions OIDC 'sub' conditions past the mandatory check, letting an overly permissive AWS role assumption go undetected. Reported by VulnCheck; no public exploit is identified at time of analysis, and it is not on CISA KEV. The CVSS 4.0 score is 9.3 (Critical).
Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudflare and deployment-governance policy violations by supplying unrelated but compliant-looking evidence. Because validators accepted stack-wide evidence shortcuts rather than correlating proof to the specific protected resource, evidence from one zone, hostname, origin, or repository could silence guardrails for a completely different resource in the same stack. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed by correlating evidence to the protected resource in 1.3.2.