Executive brief
A security bypass was found in @hulumi/policies, a library used to enforce security guardrails and compliance policies for cloud infrastructure. The software failed to correctly identify certain administrative permissions in IAM policies, which could allow users to gain unauthorized high-level access to cloud environments. This could lead to unauthorized configuration changes or full administrative control over cloud resources.
Technical details
A vulnerability in @hulumi/policies (versions prior to 1.3.2) results in an improper privilege management flaw (CWE-269). The library's administrator-policy guardrail failed to fully inspect the evidence within inline and attached IAM policy shapes. Consequently, certain policy configurations that grant administrative or admin-equivalent privileges could bypass the intended security validation. This allows for the deployment of overly permissive IAM roles that should have been blocked by the CIS 1.16 compliance check. The issue is resolved in version 1.3.2, which includes improved policy inspection and regression tests.
Affected products
- Hulumi @hulumi/policies < 1.3.2
Timeline
- 2026-05-15: disclosed: Initial disclosure by maintainer
- 2026-05-21: advisory: GitHub Advisory published
- 2026-05-21: patched: Fix released in version 1.3.2