Vendor
Security Policy Bypass in @hulumi/policies via Parent Spoofing
2 TTPs 1 CVEThe @hulumi/policies package before version 1.3.2 is vulnerable to a parent spoofing attack that allows unauthorized actors to bypass security policy enforcement during bucket configuration validation.
Improper Provenance Validation in @hulumi/drift
1 CVEThe @hulumi/drift package versions prior to 1.3.2 are susceptible to malicious reconciliation plan injection due to insufficient validation of externally supplied execute plans.
Privilege Escalation in hulumi via IAM Policy Misconfiguration
3 TTPs 1 CVEhulumi versions before v1.3.2 contain a privilege escalation vulnerability in the weekly integration IAM policy that permits unauthorized role lifecycle operations on af-e2e-* roles.
@hulumi/policies Evidence Bypass Vulnerability
2 rules@hulumi/policies versions before 1.3.2 allowed unrelated compliant-looking evidence to suppress violations for different zones, hostnames, origins, or repositories in the same stack, bypassing Cloudflare and deployment-governance guardrails.