CVE-2026-82855: @hulumi/policies Cross-Resource Evidence Validation Bypass

Overview

A critical evidence-validation bypass has been disclosed in @hulumi/policies, the guardrail/policy-as-code package used to enforce infrastructure-governance rules across Cloudflare and cloud deployment stacks. Tracked as CVE-2026-82855, the flaw allows an attacker to suppress a policy violation by submitting compliant-looking evidence that was actually generated for a different resource in the same stack.

This is part of a batch of related critical advisories disclosed the same day across the hulumi / @hulumi/policies / @hulumi/drift package family — see CVE-2026-82856 and CVE-2026-82857 for two of the companion issues.

Technical Details

How It Works

Prior to 1.3.2, the Cloudflare and deployment-governance validators in @hulumi/policies used a stack-wide evidence shortcut: evidence proving compliance was associated with the entire deployment stack rather than being bound to the specific resource it was meant to justify.

That design flaw meant an attacker could present evidence generated for one resource — for example, a zone, hostname, origin, or repository — and have it silently satisfy a guardrail protecting a completely unrelated resource in the same stack. Because the system never performed a lineage or ownership check tying evidence back to the resource it claimed to cover, the policy engine could be "poisoned" with foreign, unrelated evidence to suppress real violations.

For example, evidence proving zone-a.example.com complies with a Cloudflare security guardrail could be reused to incorrectly satisfy a guardrail meant to protect zone-b.example.com.

Impact Assessment

Who Is At Risk

Any organization using @hulumi/policies (before 1.3.2) to enforce Cloudflare or deployment-governance guardrails across multi-resource stacks is affected. The risk is highest in environments where:

• Multiple resources (zones, hostnames, repositories) are governed within a single stack
• Guardrail evidence is generated or supplied by parties with less-than-full trust (e.g., CI pipelines, third-party integrations, or less-privileged contributors)

Potential Consequences

1. Guardrail Suppression — a misconfigured or non-compliant resource can be waved through by borrowing unrelated compliant evidence
2. Policy Drift — governance dashboards report false compliance while real misconfigurations persist
3. Downstream Trust Failures — automated deployment gates relying on this guardrail can approve unsafe changes

Mitigation

Immediate Actions

• Upgrade @hulumi/policies to 1.3.2 or later, which introduces strict evidence-to-resource correlation and regression tests against cross-resource evidence spoofing
• Audit recent guardrail approvals for stacks with multiple resources to confirm evidence genuinely corresponds to the resource it was applied against
• Restrict who can supply evidence into policy validation pipelines, particularly in shared or multi-tenant stacks

Detection Opportunities

• Review policy-engine logs for evidence references that don't match the resource identifier of the guardrail they satisfied
• Look for repeated reuse of the same evidence payload across multiple, unrelated resource checks

Related Advisories

This disclosure batch also includes CVE-2026-82856 (OIDC trust policy bypass), CVE-2026-82857 (IAM privilege escalation), and several additional hulumi-family issues (CVE-2026-82858 through CVE-2026-82863), all fixed in the 1.3.2 release line. Organizations running any hulumi or @hulumi/* package should upgrade the full stack, not just @hulumi/policies.

References

• GitHub Security Advisory — GHSA-59f3-7227-wmh4
• OffSeq Threat Radar — CVE-2026-82855
• NVD — CVE-2026-82855