'@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.

CVE-2026-82855 affects @hulumi/policies versions before 1.3.2, exposing an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators. Attackers can exploit this flaw by submitting compliant evidence from unrelated zones, hostnames, origins, or repositories to suppress policy violations. This allows bypassing security guardrails for unrelated resources within the same stack. The vulnerability undermines the integrity of policy enforcement mechanisms designed to govern deployments and Cloudflare configurations. The issue is resolved in version 1.3.2 of the package. The vulnerability has been assigned a high criticality rating, indicating significant risk to affected deployments. Organizations using @hulumi/policies for infrastructure governance should upgrade immediately to mitigate potential exploitation.