Executive brief
@hulumi/policies is a governance library that enforces compliance rules for Cloudflare configurations and deployment practices. Versions before 1.3.2 had a flaw where unrelated compliance evidence from one resource could suppress security violations in different resources within the same deployment stack, allowing attackers to bypass critical guardrails. This could allow non-compliant configurations to pass validation checks.
Technical details
@hulumi/policies is a governance validation library for Cloudflare and deployment configurations. The vulnerability is a protection mechanism failure (CWE-693) in which validators incorrectly use stack-wide evidence caching to validate compliance. When checking if evidence exists for a violation, the library uses shortcuts that do not correlate evidence to the specific protected resource (zone, hostname, origin, or repository). An attacker can submit compliant-looking evidence for one resource to suppress violations reported for a different, unrelated resource in the same deployment stack. This allows non-compliant configurations to bypass governance guardrails. The flaw requires no authentication or user interaction, as it operates at the validator layer. Patched in version 1.3.2, which correlates evidence to specific resources and includes regression tests.
Affected products
- hulumi @hulumi/policies < 1.3.2
Timeline
- 2026-05-21: disclosed: Advisory GHSA-59f3-7227-wmh4 published
- 2026-05-21: patched: Version 1.3.2 released with fix