{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-82860/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hulumi:policies:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-82855"},{"id":"CVE-2026-82860"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["@hulumi/policies (\u003c 1.3.2)"],"_cs_severities":["critical"],"_cs_tags":["authorization-bypass","cve-2026-82860","iam"],"_cs_type":"advisory","_cs_vendors":["Hulumi"],"content_html":"\u003cp\u003eThe @hulumi/policies package contains a critical evidence validation bypass vulnerability affecting its Cloudflare and deployment-governance validators. In versions prior to 1.3.2, the logic responsible for verifying security compliance fails to strictly enforce the association between the submitted evidence and the specific resource being evaluated. Consequently, an attacker can submit compliant evidence obtained from a legitimate, different resource - such as a separate Cloudflare zone, hostname, origin, or repository - to satisfy the validation checks for a target resource that would otherwise trigger a violation. This vulnerability effectively allows for the bypassing of security guardrails within a shared stack, potentially permitting the deployment or configuration of non-compliant resources. The flaw stems from a lack of scoping in the validation mechanism, making the guardrails susceptible to input manipulation where legitimate data is repurposed to bypass compliance controls.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability carries a CVSS v3.1 base score of 9.8, indicating the potential for high-impact security misconfigurations. Successful exploitation allows an attacker to bypass critical security guardrails, facilitating the deployment of unauthorized or non-compliant infrastructure and services. This impacts organizations relying on automated governance and policy enforcement within their Cloudflare and deployment pipelines, as the integrity of these validation checks is compromised.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the upgrade of the @hulumi/policies package to version 1.3.2 or later across all deployment pipelines and governance engines. If an immediate upgrade is not feasible, implement manual auditing of security policy violations for sensitive stacks, as automated alerts may be suppressed by malicious evidence submission. Monitor CI/CD logs for submissions involving cross-resource evidence references, as these are indicators of potential exploitation attempts.\u003c/p\u003e\n","date_modified":"2026-08-31T11:17:13Z","date_published":"2026-08-31T11:16:33Z","id":"https://feed.craftedsignal.io/briefs/2026-08-hulumi-policies-bypass-6da4ce8d/","summary":"An evidence validation flaw in @hulumi/policies versions prior to 1.3.2 allows attackers to suppress security violations by submitting valid, but unrelated, evidence from other resources.","title":"Evidence Validation Bypass in @hulumi/policies","url":"https://feed.craftedsignal.io/briefs/2026-08-hulumi-policies-bypass-6da4ce8d/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-82860","version":"https://jsonfeed.org/version/1.1"}