CVE-2026-82861
@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 31, 2026
- Updated
- Oct 8, 2026
- Reserved
- Aug 31, 2026
Description
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucket configurations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
policieshulumi |
|
References
- GitHub Security Advisory (GHSA-g43v-9x7q-83pq)vendor-advisory
- VulnCheck Advisory: @hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypassthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.