A critical (CVSS 9.8) flaw in the @hulumi/policies npm package lets attackers suppress policy violations by submitting unrelated compliant evidence, bypassing security guardrails on resources they do not control.
What Is It
CVE-2026-82855 is an evidence validation bypass in the Cloudflare and deployment-governance validators shipped in @hulumi/policies versions before 1.3.2. The validators fail to bind submitted evidence to the resource being evaluated, so an attacker can suppress violations by supplying compliant evidence drawn from a different zone, hostname, origin, or repository within the same stack.
The issue is classified as CWE-693 (Protection Mechanism Failure). It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and a CVSS 4.0 score of 9.3 (CRITICAL). Exploitation requires no privileges, no user interaction, and can be performed over the network at low attack complexity.
Why It Matters
This is a failure of the control plane rather than a single misconfigured resource. Policy-as-code validators exist to block non-compliant deployments; when evidence from an unrelated resource satisfies a check, the guardrail reports a pass while the actual resource remains unevaluated. Confidentiality, integrity, and availability impacts are all rated HIGH.
Because evidence can be reused across zones, hostnames, origins, and repositories in the same stack, a single legitimately compliant resource could potentially be leveraged to launder approval for other resources evaluated under the same governance checks. The practical blast radius will depend on how a given stack is structured and which validators are in use.
What's Vulnerable
- Package:
@hulumi/policies(npm,pkg:npm/%40hulumi/policies) - Vendor/Product: hulumi / policies
- Affected versions: all versions before 1.3.2 (semver)
- Not affected: 1.3.2 and later
- Affected components: Cloudflare validators, deployment-governance validators
No CPE entries are currently listed in the NVD record.
Patch Status
Version 1.3.2 is designated unaffected. Upgrade @hulumi/policies to 1.3.2 or later. The CVE record was published 2026-08-31 and is currently in "Received" status via VulnCheck as the assigning source; NVD analysis is not yet complete.
No CISA KEV entry was supplied for this CVE, so there is no publicly confirmed evidence of active exploitation and no KEV-mandated remediation deadline at this time. Absence from KEV reflects what has been reported publicly as of the record's publication and does not by itself rule out exploitation in the wild.
Sources
- NVD, CVE-2026-82855: https://nvd.nist.gov/vuln/detail/CVE-2026-82855
- GitHub Security Advisory GHSA-59f3-7227-wmh4: https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-59f3-7227-wmh4
- VulnCheck Advisory: https://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-evidence-validation-bypass