Executive brief
@hulumi/policies is a library that implements policy validation for a security component called HULUMI-H1 that protects cloud storage buckets. A flaw in versions before 1.3.2 allowed attackers to spoof parent bucket evidence, bypassing security policy checks and potentially exposing unsafe bucket configurations that should have been blocked.
Technical details
The vulnerability is an improper access control issue (CWE-284) in @hulumi/policies versions prior to 1.3.2 where the validator failed to properly correlate evidence with expected component/resource relationships. This allowed an attacker to submit forged SecureBucket parent evidence during policy evaluation, causing the validator to incorrectly approve unsafe bucket shapes that should have been rejected. The attack requires network access to the policy evaluation service but no authentication or user interaction. The issue has been patched in version 1.3.2, which now enforces proper evidence correlation and includes regression tests.
Affected products
- Hulumi @hulumi/policies before 1.3.2
Timeline
- 2026-05-21: disclosed
- 2026-05-21: patched: Fixed in version 1.3.2