{"id":"EUVD-2026-68448","enisaUuid":"03de5dcb-b2a7-32d1-9426-4cae95a4ae93","description":"@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.","datePublished":"Aug 31, 2026, 8:46:32 AM","dateUpdated":"Oct 8, 2026, 3:25:36 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-4xrh-5m3m-328w\nhttps://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-admin-policy-bypass\n","aliases":"CVE-2026-82860\nGHSA-9pm9-rvf2-mhqv\n","assigner":"VulnCheck","epss":0.54,"enisaIdProduct":[{"id":"d79d9c16-7ba0-32f0-a431-3bc13c6bde3f","product":{"name":"policies","vendor":{"name":"hulumi"}},"product_version":"0 \u003c1.3.2"}],"enisaIdVendor":[{"id":"89e86fd3-1697-39d0-9cbd-69b7d4697acd","vendor":{"name":"hulumi"}}],"enisaIdVulnerability":[{"id":"18b04062-b991-3a93-a55a-3e721a1c8eff","vulnerability":{"id":"GHSA-9pm9-rvf2-mhqv","description":"@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.","datePublished":"Aug 31, 2026, 9:30:31 AM","dateUpdated":"Aug 31, 2026, 9:30:31 AM","baseScore":0.0,"references":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-4xrh-5m3m-328w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-82860\nhttps://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-admin-policy-bypass\n","enisa_id":"EUVD-2026-68448\n","aliases":"GHSA-9pm9-rvf2-mhqv\nCVE-2026-82860\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:52:25 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"20ada052-c5e4-3c85-a47f-4bd4d1b09bd2","vulnerability":{"id":"CVE-2026-82860","description":"@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.","datePublished":"Aug 31, 2026, 8:46:32 AM","dateUpdated":"Oct 8, 2026, 3:25:36 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-4xrh-5m3m-328w\nhttps://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-admin-policy-bypass\n","enisa_id":"EUVD-2026-68448\n","assigner":"VulnCheck","epss":0.54,"dataProcessed":"Nov 9, 2026, 3:06:43 PM","vulnerabilityProduct":[{"id":"0ba4da51-ee28-336f-b23e-97bd1e1a738a","product":{"name":"policies","vendor":{"name":"hulumi"}},"product_version":"0 \u003c1.3.2"}],"vulnerabilityVendor":[{"id":"52e84371-c3dc-30a3-995a-628c7cac78b6","vendor":{"name":"hulumi"}}]}}],"enisaIdAdvisory":[]}