CVE-2026-82855

The @hulumi/policies package before version 1.3.2 contains an evidence validation bypass (CWE-693, protection mechanism failure) in its Cloudflare and deployment-governance validators, which fail to confirm that submitted compliance evidence belongs to the resource being checked. An attacker triggers the flaw by submitting compliant evidence taken from a different zone, hostname, origin, or repository than the resource under evaluation within the same stack. As a result, policy violations can be suppressed and security guardrails for unrelated resources in the same stack can be bypassed, letting non-compliant deployments pass governance checks. Any team running @hulumi/policies versions before 1.3.2 in automated policy-enforcement or deployment pipelines is affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates roughly a 0.3% probability of exploitation within 30 days.

What to do: Upgrade @hulumi/policies to version 1.3.2 or later, which corrects the evidence-matching checks in the Cloudflare and deployment-governance validators. Until upgraded, manually review recent policy approvals to confirm that submitted evidence actually corresponds to the zone, hostname, origin, or repository it certifies, and treat automated 'compliant' results from older versions as unverified.