← Database

CVE-2026-82856

CRITICAL CVSS: 9.8 Published: 2026-08-31 Modified: 2026-08-31

Description

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.

Affected Platforms

Unknown

Weakness Type

CWE-284

References