Executive brief
Hulumi is a toolkit used to build secure cloud infrastructure. A flaw in its security policy engine allowed certain identity permissions (IAM roles) to bypass safety checks if they were configured to trust multiple login providers simultaneously. This could allow an attacker to gain unauthorized access to cloud environments, potentially leading to full administrative control or data exposure, while the system incorrectly reported that the configuration was secure.
Technical details
A vulnerability exists in the @hulumi/policies package where IAM-role policy checks (G_OIDC_1 and G_OIDC_2) can be bypassed. The root cause is an incorrect comparison (CWE-697) when the Principal.Federated field in an AWS IAM trust policy contains an array of multiple providers. The toolkit coerced the provider list into a single comma-joined string, causing the matcher to fail to identify the GitHub OIDC provider. Consequently, the policy engine would skip critical wildcard 'sub' condition checks and blast-radius validations. An attacker could exploit this by configuring a role with a wildcard condition that allows untrusted entities (such as pull requests from forks) to assume highly privileged roles. The issue is patched in version 1.4.0.
Affected products
- kerberosmansour @hulumi/policies < 1.4.0
Timeline
- 2026-05-19: other: Fixes merged in pull request 178
- 2026-05-20: patched: Version 1.4.0 released
- 2026-07-24: disclosed: CVE-2026-48032 published