CVE-2026-82855
Received Received - Intake

evidence validation bypass in @hulumi/policies

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82855
EUVD
EUVD-2026-68443

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hulumi policies to 1.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects @hulumi/policies versions before 1.3.2 and allows attackers to bypass security checks by submitting unrelated compliant evidence. For example, evidence from one zone or repository could suppress violations for a different protected resource in the same stack.

Detection Guidance

Check installed versions of @hulumi/policies using npm list @hulumi/policies or npm list -g @hulumi/policies. If version is below 1.3.2, the system is vulnerable. Review Cloudflare and deployment-governance validator logs for evidence submission patterns that suppress violations without proper correlation to protected resources.

Impact Analysis

Attackers could evade detection and maintain unauthorized access by tricking the system into ignoring violations. This could lead to unauthorized changes, data breaches, or continued presence in compromised systems without triggering alerts.

Compliance Impact

This vulnerability could undermine compliance efforts by allowing unauthorized access or changes to go undetected. For GDPR, it may violate data protection requirements for monitoring and breach detection. For HIPAA, it could fail to detect unauthorized access to protected health information.

Mitigation Strategies

Upgrade @hulumi/policies to version 1.3.2 or later using npm install @hulumi/policies@latest. Verify the update with npm list @hulumi/policies. Review and update validator configurations to ensure evidence is properly linked to specific resources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82855. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart