CVE-2026-82860
Received Received - Intake

@hulumi/policies Policy Bypass via Incomplete IAM Policy Inspection

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: VulnCheck

Description
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-82860
EUVD
EUVD-2026-68448

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hulumi policies to 1.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-82860 is a critical vulnerability in @hulumi/policies versions before 1.3.2 where the software fails to properly inspect IAM policy evidence for admin-policy guardrails. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls, leading to improper privilege management.

Detection Guidance

Check the installed version of @hulumi/policies using npm list @hulumi/policies. If the version is below 1.3.2, the system is vulnerable. Review IAM policy configurations for admin-equivalent paths that may bypass guardrails.

Impact Analysis

This vulnerability allows attackers to gain admin-equivalent privileges without proper authorization. It can lead to unauthorized access, privilege escalation, and improper control over cloud resources. The flaw is remotely exploitable without user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access or privilege escalation, violating data protection requirements in GDPR and HIPAA. It undermines access control measures, potentially resulting in non-compliance with these regulations.

Mitigation Strategies

Upgrade @hulumi/policies to version 1.3.2 or later immediately. Review and audit IAM policies to ensure no admin-equivalent paths bypass guardrails. Apply patches and monitor for unusual privilege escalations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82860. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart