CVE-2026-82860: @hulumi/policies Auth Bypass Vulnerability

CVE-2026-82860 Overview

CVE-2026-82860 is a privilege escalation vulnerability [CWE-269] in the @hulumi/policies npm package before version 1.3.2. The package fails to fully inspect inline and attached Identity and Access Management (IAM) policy evidence when enforcing the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that evade the policy evaluation controls and gain administrative privileges.

Critical Impact
Remote, unauthenticated attackers can bypass the administrator-policy guardrail and provision admin-equivalent IAM policies without triggering enforcement.

Affected Products

@hulumi/policies npm package, all versions prior to 1.3.2
Applications and infrastructure-as-code pipelines that rely on the administrator-policy guardrail from @hulumi/policies
Downstream services consuming IAM policy evaluation results from vulnerable versions

Discovery Timeline

2026-08-31 - CVE-2026-82860 published to the National Vulnerability Database
2026-08-31 - Last updated in the NVD database

Technical Details for CVE-2026-82860

Vulnerability Analysis

The @hulumi/policies package enforces an administrator-policy guardrail that is intended to detect and block IAM policies granting administrator-equivalent access. The guardrail inspects policy evidence attached to identities and roles, then rejects any configuration matching an admin-equivalent pattern.

The inspection logic does not fully traverse inline and attached IAM policy evidence. Attackers can shape a policy so that its effective permissions equal administrator access while its structure sidesteps the guardrail's evaluation path. The guardrail returns a compliant verdict, and the admin-equivalent policy is provisioned.

The issue is scored under CVSS v4.0 with network attack vector, no privileges required, and no user interaction, reflecting exploitation by any actor who can submit policy definitions to a pipeline that uses the guardrail.

Root Cause

The root cause is incomplete evaluation of IAM policy evidence within the administrator-policy check. Inline statements, attached policy references, and equivalent permission constructs are not fully expanded before comparison against admin-equivalent patterns. This leaves multiple representations of administrative access outside the guardrail's inspection scope, aligning with the CWE-269 improper privilege management weakness class.

Attack Vector

An attacker who can influence IAM policy definitions submitted to a @hulumi/policies-protected pipeline crafts a policy path whose effective grants are equivalent to administrator access but whose representation avoids the guardrail's matchers. The guardrail approves the policy, and the target identity receives administrator-equivalent permissions in the downstream cloud environment. No authentication or user interaction is required against the guardrail itself.

Refer to the GitHub Security Advisory GHSA-4xrh-5m3m-328w and the VulnCheck Advisory: Admin Policy Bypass for additional technical context.

Detection Methods for CVE-2026-82860

Indicators of Compromise

Policy evaluation logs showing a compliant verdict from @hulumi/policies immediately followed by provisioning of policies containing wildcard Action: "*" or Resource: "*" grants.
Identities or roles that unexpectedly receive AWS AdministratorAccess, Azure Owner, or Google Cloud roles/owner bindings shortly after a pipeline run.
Presence of @hulumi/policies versions below 1.3.2 in package-lock.json, yarn.lock, or pnpm-lock.yaml files across build environments.

Detection Strategies

Perform software composition analysis on CI/CD systems to flag any dependency graph that resolves @hulumi/policies below 1.3.2.
Add an out-of-band IAM policy analyzer, such as a cloud provider access analyzer, that re-evaluates every policy admitted by the guardrail and alerts on admin-equivalent effective permissions.
Diff generated IAM policy plans against a signed baseline before apply, and fail the pipeline on any privilege delta not authorized in change management.

Monitoring Recommendations

Stream cloud audit logs (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) into a centralized data lake and alert on AttachRolePolicy, PutRolePolicy, and role-assignment events that produce admin-equivalent access.
Monitor identity providers for new privileged role assignments generated by service principals tied to infrastructure-as-code pipelines.
Track version drift for @hulumi/policies in build agents and reject builds that pin vulnerable versions.

How to Mitigate CVE-2026-82860

Immediate Actions Required

Upgrade @hulumi/policies to version 1.3.2 or later across all pipelines, build agents, and developer workstations.
Re-run the administrator-policy guardrail on all recently provisioned IAM policies and revoke any admin-equivalent grants that were not explicitly approved.
Rotate credentials for identities that received policies through vulnerable guardrail versions during the exposure window.

Patch Information

The maintainers address CVE-2026-82860 in @hulumi/policies version 1.3.2, which expands inline and attached IAM policy inspection to fully cover admin-equivalent policy paths. Consult the GitHub Security Advisory GHSA-4xrh-5m3m-328w for the fixed release and change details.

Workarounds

Layer an independent IAM policy analyzer in the pipeline that rejects policies granting effective administrator access, regardless of guardrail verdict.
Restrict the identities allowed to submit or approve IAM policy changes, and require multi-party approval for any policy touching privileged roles.
Enforce deny-by-default service control policies or Azure management group policies that block wildcard permissions except for explicitly designated break-glass accounts.

bash

# Upgrade @hulumi/policies to the patched release
npm install @hulumi/policies@^1.3.2

# Verify the resolved version in the lockfile
npm ls @hulumi/policies

# Fail CI builds if a vulnerable version resolves
npm audit --audit-level=high