CVE-2026-82856
Received Received - Intake

AWS IAM Condition Operator Bypass in @hulumi/policies

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82856
EUVD
EUVD-2026-68444

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hulumi policies to 1.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82856 is a vulnerability in @hulumi/policies versions before 1.3.2 where AWS IAM condition operators in GitHub OIDC trust policies are not properly validated. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions, bypassing security controls.

Detection Guidance

Check installed versions of @hulumi/policies using npm list @hulumi/policies. If the version is below 1.3.2, the system is vulnerable. Inspect GitHub OIDC trust policies for AWS IAM condition operators using ForAnyValue:StringLike to detect hidden wildcard conditions.

Impact Analysis

This vulnerability allows attackers to bypass security guardrails by concealing malicious GitHub Actions OIDC subject conditions. It could lead to unauthorized access to AWS resources if exploited, potentially causing data breaches or resource misuse.

Mitigation Strategies

Upgrade @hulumi/policies to version 1.3.2 or later immediately. Review and update GitHub OIDC trust policies to remove unsafe ForAnyValue:StringLike operators. Ensure all AWS IAM condition operators are properly validated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82856. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart