Is CVE-2026-82861 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82861 being exploited in the wild.

How severe is CVE-2026-82861?

High severity, with a CVSS score of 7.5, published 31 August 2026.

Which products and versions are affected?

@hulumi/policies (npm) SEMVER:introduced=0,fixed=1.3.2.

Is there a fix for CVE-2026-82861?

Yes. @hulumi/policies (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82861 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82861?

Check whether you run @hulumi/policies (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82861: @hulumi/policies SecureBucket parent spoof bypass

CVE-2026-82861 · Severity: high · CVSS 7.5 · Published 2026-08-31

@hulumi/policies is a library that implements policy validation for a security component called HULUMI-H1 that protects cloud storage buckets. A flaw in versions before 1.3.2 allowed attackers to spoof parent bucket evidence, bypassing security policy checks and potentially exposing unsafe bucket configurations that should have been blocked.

Technologies: @hulumi/policies (npm). Vendors: npm.

Quick answers

Is CVE-2026-82861 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82861 being exploited in the wild.
How severe is CVE-2026-82861?: High severity, with a CVSS score of 7.5, published 31 August 2026.
Which products and versions are affected?: @hulumi/policies (npm) SEMVER:introduced=0,fixed=1.3.2.
Is there a fix for CVE-2026-82861?: Yes. @hulumi/policies (npm): upgrade to 1.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82861 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82861?: Check whether you run @hulumi/policies (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@hulumi/policies (npm): upgrade to 1.3.2 or later
```
npm install @hulumi/policies@1.3.2
```

Technical details

The vulnerability is an improper access control issue (CWE-284) in @hulumi/policies versions prior to 1.3.2 where the validator failed to properly correlate evidence with expected component/resource relationships. This allowed an attacker to submit forged SecureBucket parent evidence during policy evaluation, causing the validator to incorrectly approve unsafe bucket shapes that should have been rejected. The attack requires network access to the policy evaluation service but no authentication or user interaction. The issue has been patched in version 1.3.2, which now enforces proper evidence correlation and includes regression tests.

Affected products

Hulumi @hulumi/policies before 1.3.2

Identifiers

CVE-2026-82861
GHSA-g43v-9x7q-83pq

Timeline

2026-05-21: disclosed
2026-05-21: patched: Fixed in version 1.3.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.