Hulumi vulnerabilities
We track 5 vulnerabilities in Hulumi products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on August 31, 2026.
Latest Hulumi vulnerabilities
- 7.5 High severity
policies: Improper Access Control
@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causi
- 9.8 Critical severity
policies: Improper Privilege Management
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.
- 9.8 Critical severity
drift: Insufficient Verification of Data Authenticity
@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to
- 9.8 Critical severity
policies: Improper Access Control
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security g
- 9.8 Critical severity
policies: Protection Mechanism Failure
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence fr