CVE-2026-82860

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence when enforcing the administrator-policy guardrail, an improper privilege management flaw (CWE-269). Because the guardrail's policy evaluation controls do not cover every policy shape, an attacker can craft admin-equivalent policy paths that pass through evaluation without being flagged. The result is that IAM policies granting effectively administrator-level permissions can be applied or approved even where the guardrail is intended to block or flag them, weakening the cloud-permission governance the library is meant to enforce. Any team or CI/CD pipeline using @hulumi/policies prior to 1.3.2 to enforce administrator-policy guardrails is affected. There is no known exploitation to date: no public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS estimates only a ~0.3% chance of exploitation in the next 30 days.

What to do: Upgrade @hulumi/policies to 1.3.2 or later anywhere the administrator-policy guardrail is enforced. Until patched, manually review recently evaluated inline and attached IAM policies for admin-equivalent grants that the guardrail may have waved through, and re-run guardrail checks over prior policy evidence after upgrading.