CVE-2026-82856 Overview
CVE-2026-82856 is a critical access control vulnerability in @hulumi/policies versions before 1.3.2. The package fails to validate set-qualified AWS Identity and Access Management (IAM) condition operators inside GitHub OpenID Connect (OIDC) trust policies. Attackers can use ForAnyValue:StringLike operators to smuggle wildcard GitHub Actions OIDC subject conditions past the library's security guardrails. The bypass permits crafted trust policies that appear compliant while permitting unauthorized workflows to assume AWS roles. The weakness is categorized under CWE-284 (Improper Access Control).
Critical Impact
Attackers who influence trust policy authoring can bypass wildcard restrictions and enable arbitrary GitHub Actions workflows to assume privileged AWS roles.
Affected Products
- @hulumi/policies versions prior to 1.3.2
- Environments using the package to validate GitHub OIDC-to-AWS IAM trust policies
- CI/CD pipelines relying on the library as a policy guardrail
Discovery Timeline
- 2026-08-31 - CVE-2026-82856 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-82856
Vulnerability Analysis
The @hulumi/policies library inspects AWS IAM trust policies to enforce restrictions on GitHub OIDC subject claims. The validator examines standard scalar condition operators such as StringEquals and StringLike when checking the token.actions.githubusercontent.com:sub claim. It does not correctly handle set-qualified variants like ForAnyValue:StringLike and ForAllValues:StringLike. Attackers exploit this gap by expressing wildcard subject patterns through the set-qualified operator, evading detection while AWS IAM still enforces the permissive match at runtime.
Root Cause
The root cause is incomplete operator coverage in the policy parser. The library treats set-qualified operators as unknown or benign rather than resolving them to the underlying comparison semantics. This omission allows a policy fragment such as ForAnyValue:StringLike with repo:*:* to pass validation, while AWS evaluates it as a wildcard match against any incoming OIDC subject.
Attack Vector
Exploitation is network-based and requires no authentication or user interaction. An attacker with the ability to submit or merge Infrastructure-as-Code changes crafts a trust policy that uses ForAnyValue:StringLike to declare permissive subject patterns. Once deployed to AWS, any GitHub Actions workflow, including one running from an attacker-controlled fork or repository, can request an OIDC token and assume the target role. The result is unauthorized access to AWS resources with the trusted role's privileges. Full technical detail is available in the GitHub Security Advisory and the VulnCheck Policy Bypass Advisory.
Detection Methods for CVE-2026-82856
Indicators of Compromise
- AWS IAM trust policies containing ForAnyValue:StringLike or ForAllValues:StringLike operators applied to token.actions.githubusercontent.com:sub.
- Trust policy subject patterns that include wildcards such as repo:* or repo:<org>/*:* under set-qualified operators.
- sts:AssumeRoleWithWebIdentity calls originating from repositories or workflows outside the intended allow list.
Detection Strategies
- Parse existing IAM trust policies and flag any use of ForAnyValue or ForAllValues qualifiers against GitHub OIDC subject claims.
- Compare policy authoring tools' output with the effective AWS-evaluated policy to detect guardrail drift.
- Audit CloudTrail AssumeRoleWithWebIdentity events and correlate the sub claim against expected repository and workflow identifiers.
Monitoring Recommendations
- Alert on IAM trust policy changes that introduce set-qualified string operators on OIDC condition keys.
- Continuously validate deployed policies with an updated policy linter rather than relying only on pre-merge checks.
- Track dependency versions of @hulumi/policies across build pipelines and fail builds that resolve to versions below 1.3.2.
How to Mitigate CVE-2026-82856
Immediate Actions Required
- Upgrade @hulumi/policies to version 1.3.2 or later across all repositories and CI/CD pipelines.
- Review every AWS IAM role that trusts token.actions.githubusercontent.com and remove ForAnyValue or ForAllValues qualifiers on the sub claim unless explicitly required.
- Rotate credentials and audit recent AssumeRoleWithWebIdentity events for roles that may have been abused.
Patch Information
The fix is available in @hulumi/policies version 1.3.2. The release adds validation for set-qualified condition operators so that ForAnyValue:StringLike and related variants are evaluated with the same wildcard restrictions as scalar operators. Refer to the GitHub Security Advisory GHSA-q2f7-m237-v562 for release notes.
Workarounds
- Enforce a policy-as-code rule that rejects any IAM trust statement containing ForAnyValue or ForAllValues on GitHub OIDC subject conditions.
- Restrict who can modify IAM trust policies and require peer review for OIDC-related changes.
- Constrain AWS role trust policies with an explicit StringEquals on aud and an allow list of exact sub values for critical roles until the library is upgraded.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.