Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: hulumi policies 1.3.2 Clear all filters
TI-2026-57165 CVE-2026-82861 · GHSA-5vxq-3j99-7xfc

@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass

Priority MEDIUM 44

@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00434 Published 2026-08-31 Fixed in 1.3.2 CWE-284
TI-2026-57164 CVE-2026-82860 · GHSA-9pm9-rvf2-mhqv

@hulumi/policies before 1.3.2 Admin Policy Bypass

Priority MEDIUM 49

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00543 Published 2026-08-31 Fixed in 1.3.2 CWE-269
TI-2026-57160 CVE-2026-82856 · GHSA-24pm-8839-wg8f

@hulumi/policies before 1.3.2 OIDC Trust Policy Bypass

Priority MEDIUM 49

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00512 Published 2026-08-31 Fixed in 1.3.2 CWE-284
TI-2026-57159 CVE-2026-82855 · GHSA-8c24-v4pw-q2pm

@hulumi/policies before 1.3.2 Evidence Validation Bypass

Priority MEDIUM 49

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00587 Published 2026-08-31 Fixed in 1.3.2 CWE-693