CVE-2026-82856

Name of the Vulnerable Software and Affected Versions @hulumi/policies versions prior to 1.3.2

Description Failure to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies allows attackers to bypass security guardrails. Specifically, the G OIDC 1 check only evaluated exact AWS IAM StringLike and StringEquals condition operator keys, failing to account for set-qualified operators such as ForAnyValue:StringLike. This oversight enables the use of wildcard GitHub Actions OIDC subject conditions that should be restricted.

Recommendations Upgrade @hulumi/policies to version 1.3.2 or later.