CVE-2026-82856 affects @hulumi/policies versions before 1.3.2, which fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can exploit this vulnerability by using ForAnyValue:StringLike operators to obscure wildcard GitHub Actions OIDC subject conditions, effectively bypassing security guardrails. This allows malicious actors to craft trust policies that appear compliant but grant overly permissive access. The vulnerability poses a significant risk in CI/CD pipelines that rely on GitHub Actions with AWS IAM role assumption via OIDC federation. The fix is available in version 1.3.2 of the package. Organizations using this library should upgrade immediately to prevent unauthorized AWS resource access. The issue has been documented in both the GitHub security advisory and VulnCheck advisories.
