CVE-2026-82861

Versions of the @hulumi/policies package before 1.3.2 fail to adequately verify the parent evidence supplied for SecureBucket policies during policy evaluation (CWE-284). An attacker who can control the evidence submitted to the validator can submit falsified parent evidence, making an insecurely configured bucket appear to pass its security policy checks. The attacker gains a bypass of security controls enforced by the validator, allowing unsafe bucket configurations to go undetected; the flaw does not itself grant access to systems. Anyone using affected versions of @hulumi/policies to evaluate SecureBucket policies — for example in automated compliance or CI/CD checks — is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and EPSS assigns a low 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade @hulumi/policies to version 1.3.2 or later. Until upgraded, do not rely solely on validator output for SecureBucket compliance: treat submitted parent evidence as untrusted, review pipeline inputs that feed evidence to the validator, and independently verify that bucket configurations (e.g., encryption and public-access settings) are actually safe.