Executive brief
@hulumi/policies is a library used to enforce security and governance rules for cloud deployments. A flaw in how it validates security evidence allows non-compliant configurations to bypass safety checks if other compliant resources exist in the same environment. This could lead to the deployment of insecure Cloudflare settings or unauthorized repository configurations that should have been blocked by corporate guardrails.
Technical details
The vulnerability is classified as a Protection Mechanism Failure (CWE-693) within the @hulumi/policies npm package. In versions prior to 1.3.2, several validators for Cloudflare and deployment governance utilized 'stack-wide evidence shortcuts' rather than correlating security evidence to specific resources. Consequently, if a single resource in a stack provided compliant evidence, the validator would incorrectly suppress violations for all other resources in that stack, including those with different zones, hostnames, or repositories. This allows an attacker or a misconfiguration to bypass intended security guardrails. The issue is resolved in version 1.3.2, which ensures evidence is correctly correlated to the specific protected resource.
Affected products
- kerberosmansour/hulumi @hulumi/policies < 1.3.2
Timeline
- 2026-05-15: disclosed: Initial disclosure by maintainer
- 2026-05-21: advisory: GitHub Advisory published
- 2026-05-15: patched: Version 1.3.2 released