CVE-2026-82855
@hulumi/policies before 1.3.2 Evidence Validation Bypass
- State
- Published
- Severity
- 9.3 Critical
- Published
- Aug 31, 2026
- Updated
- Oct 8, 2026
- Reserved
- Aug 31, 2026
Description
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-693 Protection Mechanism Failure
Affected Products
| Product | Versions |
|---|---|
policieshulumi |
|
References
- GitHub Security Advisory (GHSA-59f3-7227-wmh4)vendor-advisory
- VulnCheck Advisory: @hulumi/policies before 1.3.2 Evidence Validation Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.