CVE-2026-82855 Overview
CVE-2026-82855 is an evidence validation bypass vulnerability in the @hulumi/policies npm package, affecting all versions before 1.3.2. The flaw resides in the Cloudflare and deployment-governance validators. These validators fail to bind submitted compliance evidence to the specific resource being evaluated. Attackers can submit unrelated compliant evidence from different zones, hostnames, origins, or repositories to suppress policy violations. This defeats the security guardrails intended to gate resource deployments within the same stack.
Critical Impact
Attackers can bypass policy-as-code guardrails and deploy non-compliant Cloudflare and infrastructure resources by replaying valid evidence from unrelated assets.
Affected Products
- @hulumi/policies npm package versions before 1.3.2
- Cloudflare validator component within @hulumi/policies
- Deployment-governance validator component within @hulumi/policies
Discovery Timeline
- 2026-08-31 - CVE-2026-82855 published to NVD
- 2026-08-31 - Last updated in NVD database
Technical Details for CVE-2026-82855
Vulnerability Analysis
The vulnerability is classified under [CWE-693: Protection Mechanism Failure]. The @hulumi/policies package implements policy validators that gate deployments by requiring compliance evidence. The Cloudflare and deployment-governance validators accept evidence documents but do not verify that the evidence corresponds to the resource under evaluation. As a result, evidence collected from a compliant zone, hostname, origin, or repository can be reused to satisfy checks on an unrelated non-compliant resource in the same stack. The exploit primitive is straightforward evidence substitution against a network-reachable policy evaluation endpoint.
Root Cause
The validators lack a binding check between the evidence subject (for example, a Cloudflare zone identifier or Git repository URL) and the target resource identifier being evaluated. Evidence is treated as generically compliant when its internal fields pass schema validation, without asserting that the evidence describes the resource under review.
Attack Vector
An attacker with the ability to submit policy evaluation inputs supplies compliant evidence taken from an unrelated but similar resource. The vulnerable validator accepts the mismatched evidence, marks the policy as satisfied, and allows a non-compliant deployment to proceed. Exploitation requires no authentication, no user interaction, and can be performed over the network.
No verified proof-of-concept code is publicly available. See the GitHub Security Advisory GHSA-59f3 and the VulnCheck Advisory: Hulumi Policy Bypass for full technical details.
Detection Methods for CVE-2026-82855
Indicators of Compromise
- Policy evaluation logs showing successful validation results paired with evidence identifiers (zone IDs, hostnames, origins, repository URLs) that do not match the target resource.
- Deployment approvals for resources whose Cloudflare zone or repository is not represented in any prior compliance scan.
- Reused evidence artifacts referenced across multiple, unrelated policy decisions within short time windows.
Detection Strategies
- Audit historical policy decisions and cross-reference the evidence subject fields against the target resource identifiers to surface mismatches.
- Compare deployment stack manifests to the evidence corpus and flag stacks where evidence coverage does not match declared resources.
- Alert on any invocation of @hulumi/policies at versions below 1.3.2 in build pipelines and CI logs.
Monitoring Recommendations
- Instrument policy engine callers to log evidence subject metadata alongside the evaluated resource identifier for every decision.
- Monitor CI/CD systems for changes to policy dependencies and pin versions to 1.3.2 or later.
- Forward policy evaluation logs to a centralized SIEM or data lake to enable retrospective queries once patched.
How to Mitigate CVE-2026-82855
Immediate Actions Required
- Upgrade @hulumi/policies to version 1.3.2 or later in every project, pipeline, and stack that consumes it.
- Re-run policy evaluations against all recent deployments to identify decisions that may have relied on substituted evidence.
- Revoke or re-verify any resource approvals granted while the vulnerable validators were in use.
Patch Information
The maintainers have released @hulumi/policies version 1.3.2, which enforces binding between evidence subjects and evaluated resources in the Cloudflare and deployment-governance validators. Refer to the GitHub Security Advisory GHSA-59f3 for fix details.
Workarounds
- Add an out-of-band verification step in CI that compares evidence subject fields to the target resource before promoting a deployment.
- Restrict who can submit evidence to policy evaluators and require signed evidence tied to a specific resource identifier.
- Temporarily disable the Cloudflare and deployment-governance validators for high-risk stacks until the upgrade is applied.
# Upgrade the vulnerable package to the fixed release
npm install @hulumi/policies@1.3.2
# Verify no transitive dependency pulls a vulnerable version
npm ls @hulumi/policies
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.