CVE-2026-82856

@pulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators when checking GitHub Actions OIDC trust policies — an improper access-control flaw (CWE-284) rated 9.3 (Critical) under CVSS 4.0. It is triggered when a trust policy uses operators such as ForAnyValue:StringLike, which the guardrail fails to inspect, allowing wildcard subject conditions (e.g., trusting any repository or branch in a GitHub organization) to pass validation that should flag or reject them. An attacker crafting a trust policy this way effectively hides broad wildcard grants from the security guardrail, so more GitHub Actions workflows can assume the associated AWS role and reach its resources than the policy intends. Any organization relying on @pulumi/policies to enforce AWS IAM and GitHub OIDC trust guardrails is affected. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation exists, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Upgrade @pulumi/policies to version 1.3.2 or later. Until then, manually review IAM roles that trust the GitHub Actions OIDC provider for set-qualified operators such as ForAnyValue:StringLike with wildcard subjects (e.g., repo:org/*) and tighten them to specific repositories and branches. Also check CloudTrail AssumeRoleWithWebIdentity logs for role assumptions from unexpected GitHub repositories or workflows.