@hulumi/policies before 1.3.2 SecureBucket Parent Spoof Bypass

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-82861 · Microsoft / collected KEV context

EUVD-2026-68449

GHSA-5vxq-3j99-7xfc

GHSA-g43v-9x7q-83pq

cve-program · CVE-2026-82861

• https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g43v-9x7q-83pq
• https://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-securebucket-parent-spoof-bypass

euvd · EUVD-2026-68449

• https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g43v-9x7q-83pq
• https://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-securebucket-parent-spoof-bypass

nvd · CVE-2026-82861

• https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g43v-9x7q-83pq
• https://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-securebucket-parent-spoof-bypass

osv · GHSA-g43v-9x7q-83pq

• https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g43v-9x7q-83pq
• https://github.com/kerberosmansour/hulumi

No related operational record is retained in the current change model.