Security readout for executives and security teams
Plain-English summary
A security policy package could miss dangerous wildcard permissions in AWS roles trusted by GitHub Actions. Consequently, a policy might appear compliant while allowing unintended GitHub workflows or repositories to obtain AWS credentials, potentially exposing cloud data and resources.
Executive priority
Treat as an urgent cloud identity-control issue where the affected package validates production AWS trust policies. Prioritize upgrades and retrospective policy review, especially for highly privileged roles. If the package is absent or never assessed deployed policies, direct exposure is unlikely.
Technical view
@hulumi/policies before 1.3.2 improperly validates set-qualified AWS IAM condition operators in GitHub OIDC trust policies. ForAnyValue:StringLike can conceal wildcard GitHub OIDC subject conditions from the package’s guardrails. The supplied record classifies this as CWE-284 with CVSS 3.1 score 9.8.
Likely exposure
Exposure is limited to environments using @hulumi/policies before 1.3.2 to validate GitHub OIDC AWS trust policies. Risk is greatest where guardrail results were trusted without separate review and set-qualified conditions or wildcard subject values were accepted.
Exploitation context
The supplied sources do not establish active exploitation, and the CVE is not identified as KEV. Exploitation would involve a crafted trust-policy condition evading validation; resulting impact depends on whether that policy is subsequently applied and what AWS permissions the trusted role holds.
Researcher notes
The failure concerns semantic handling of set-qualified IAM condition operators, not ordinary string matching alone. Researchers should compare validation behavior across pre-1.3.2 and fixed releases without deploying permissive policies. The supplied evidence does not quantify affected deployments, confirm exploitation, or describe additional bypass variants.
Mitigation direction
- Upgrade @hulumi/policies to version 1.3.2 or later.
- Review vendor guidance before deploying the updated package.
- Reassess previously approved GitHub OIDC trust policies for wildcard subject conditions.
- Restrict trusted subjects and associated AWS role permissions to required repositories and workflows.
Validation and detection
- Inventory deployed and CI dependencies for @hulumi/policies versions earlier than 1.3.2.
- Identify trust policies previously evaluated by affected versions.
- Review set-qualified condition operators, especially ForAnyValue:StringLike, for wildcard GitHub OIDC subjects.
- Repeat policy validation with version 1.3.2 or later.
- Confirm each trusted GitHub subject and AWS permission remains explicitly required.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-82856 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitHub Security Advisory (GHSA-q2f7-m237-v562)CVE reference, VulnCheck · vendor-advisory
- VulnCheck Advisory: @hulumi/policies before 1.3.2 OIDC Trust Policy BypassCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.