Executive brief
A security bypass exists in @hulumi/policies, a library used to enforce security guardrails on cloud infrastructure policies. An attacker could bypass mandatory security checks for GitHub Actions authentication, potentially allowing unauthorized access to AWS resources. This could lead to a full compromise of cloud environments by allowing untrusted GitHub repositories to assume sensitive roles.
Technical details
The vulnerability exists in the AWS trust-policy inspector component of @hulumi/policies (specifically rule G_OIDC_1). Prior to version 1.3.2, the inspector only validated exact AWS IAM condition operators like 'StringLike' or 'StringEquals'. Attackers could bypass these checks by using set-qualified operators such as 'ForAnyValue:StringLike', which the library failed to recognize. This allows the inclusion of unsafe wildcard GitHub Actions OIDC 'sub' conditions that should have been rejected by the mandatory guardrail. Successful exploitation allows an attacker to configure or exploit trust relationships that permit unauthorized GitHub identities to assume AWS IAM roles. The issue is fixed in version 1.3.2.
Affected products
- kerberosmansour @hulumi/policies < 1.3.2
Timeline
- 2026-05-15: disclosed
- 2026-05-21: advisory
- 2026-05-15: patched: Version 1.3.2 released