{"id":"EUVD-2026-68444","enisaUuid":"b5ef329a-ec6d-303c-b58d-d1345e1dbe1a","description":"@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.","datePublished":"Aug 31, 2026, 8:46:29 AM","dateUpdated":"Oct 8, 2026, 3:25:33 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-q2f7-m237-v562\nhttps://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-oidc-trust-policy-bypass\n","aliases":"CVE-2026-82856\nGHSA-24pm-8839-wg8f\n","assigner":"VulnCheck","epss":0.51,"enisaIdProduct":[{"id":"c968ca15-230f-3b26-b219-a95ff8f8f97a","product":{"name":"policies","vendor":{"name":"hulumi"}},"product_version":"0 \u003c1.3.2"}],"enisaIdVendor":[{"id":"6ef4b6b8-2fd7-39d4-a973-0af97801b0f0","vendor":{"name":"hulumi"}}],"enisaIdVulnerability":[{"id":"98d768d9-a8a1-324c-91ac-ad4b18267952","vulnerability":{"id":"GHSA-24pm-8839-wg8f","description":"@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.","datePublished":"Aug 31, 2026, 9:30:30 AM","dateUpdated":"Aug 31, 2026, 9:30:30 AM","baseScore":0.0,"references":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-q2f7-m237-v562\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82856\nhttps://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-oidc-trust-policy-bypass\n","enisa_id":"EUVD-2026-68444\n","aliases":"GHSA-24pm-8839-wg8f\nCVE-2026-82856\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:52:25 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a62af800-3d7e-357d-9f01-7feac3ac024d","vulnerability":{"id":"CVE-2026-82856","description":"@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.","datePublished":"Aug 31, 2026, 8:46:29 AM","dateUpdated":"Oct 8, 2026, 3:25:33 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-q2f7-m237-v562\nhttps://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-oidc-trust-policy-bypass\n","enisa_id":"EUVD-2026-68444\n","assigner":"VulnCheck","epss":0.51,"dataProcessed":"Nov 9, 2026, 3:06:43 PM","vulnerabilityProduct":[{"id":"d3bee9c1-8f1b-3604-a528-369f0c761801","product":{"name":"policies","vendor":{"name":"hulumi"}},"product_version":"0 \u003c1.3.2"}],"vulnerabilityVendor":[{"id":"e4c7cf74-20be-3f10-bf79-7535ca67163c","vendor":{"name":"hulumi"}}]}}],"enisaIdAdvisory":[]}