CVE-2026-48032

Name of the Vulnerable Software and Affected Versions @hulumi/policies versions prior to 1.4.0

Description IAM-role policy checks can be bypassed when a role trusts multiple OIDC (OpenID Connect) providers. The issue occurs when the Principal.Federated field contains a JSON array of multiple providers; the system coerces this list into a single comma-joined string, causing the matcher to fail to recognize GitHub Actions as one of the providers. Consequently, the G OIDC 1 and G OIDC 2 policy rules skip necessary wildcard checks for sub: conditions. This allows IAM roles with overly permissive conditions—which could let untrusted pull requests from forks assume the role—to be reported as compliant. Additionally, the G OIDC 2 detector fails to perform blast-radius checks for cluster-admin or AdministratorAccess permissions in these scenarios.

Recommendations Upgrade @hulumi/policies to version 1.4.0.