Skip to content
Threat Feed
Subscribe

Tag

Trust-Policy

1 brief RSS
critical advisory

@hulumi/policies GitHub OIDC Trust Policy Bypass via AWS Set-Qualified Condition Operators

@hulumi/policies versions before 1.3.2 are vulnerable to a critical trust policy bypass where set-qualified operators such as ForAnyValue:StringLike could hide wildcard GitHub Actions OIDC sub conditions from the mandatory guardrail, potentially allowing unauthorized access to AWS resources.

@hulumi/policies +1 github aws iam oidc trust-policy
2r 1t