What’s Vulnerable › Vulnerabilities

CVE-2026-82855: @hulumi/policies before 1.3.2 Evidence Validation Bypass

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-31 · updated 2026-10-08
• Weakness: CWE-693

Description

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.

Affected products

• hulumi policies: before 1.3.2 — fixed in 1.3.2

How to fix

Upgrade to a fixed version: hulumi policies 1.3.2. Check the vendor advisory for mitigations.

References

• https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-59f3-7227-wmh4
• https://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-evidence-validation-bypass

Get alerted when CVE-2026-82855 or the next vulnerability affects your stack