CVE-2026-82860 — @hulumi/policies before 1.3.2 Admin Policy Bypass
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent…
Published: 2026-08-31 · CVSS: 9.3 · CVSS 4.0
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7