Evidence Validation Bypass in Hulumi Policies by Hulumi
CVE-2026-82855

9.3CRITICAL

Key Information:

Vendor

Hulumi

Status
Policies
Vendor
CVE Published:
31 August 2026

What is CVE-2026-82855?

The Hulumi Policies product, particularly versions prior to 1.3.2, is affected by an evidence validation bypass vulnerability. This vulnerability allows attackers to circumvent security checks by submitting non-related compliant evidence. By exploiting this flaw, attackers may leverage evidence from various zones, hostnames, origins, or repositories, effectively breaking the guardrails designed to ensure compliance across unrelated resources within the same stack.

Affected Version(s)

policies 0 < 1.3.2

policies 1.3.2

References

https://github.com/kerberosmansour/hulumi/security/adviso...
vendor-advisory
https://www.vulncheck.com/advisories/hulumi-policies-befo...
third-party-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.