Executive brief
@hulumi/policies is a library used to enforce security policies on cloud infrastructure resources. A vulnerability in the policy evaluation engine allows users to bypass security checks by providing spoofed evidence about a resource's parent container. This could result in unsafe or insecurely configured storage buckets being deployed despite existing security policies intended to block them.
Technical details
A vulnerability in @hulumi/policies (specifically affecting HULUMI-H1) allows for a parent spoofing bypass during policy evaluation. The validator failed to properly correlate provided evidence with the actual component/resource relationship, allowing it to accept spoofed SecureBucket parent evidence. An attacker can exploit this to make an unsafe bucket configuration appear compliant, bypassing security policy enforcement. This is classified as Improper Access Control (CWE-284). The issue is resolved in version 1.3.2, which introduces stricter evidence correlation and validation.
Affected products
- Hulumi @hulumi/policies < 1.3.2
Timeline
- 2026-05-15: disclosed: Advisory published by maintainer
- 2026-05-21: advisory: GitHub Advisory Database entry reviewed
- 2026-05-15: patched: Version 1.3.2 released