CVE-2026-82856 affects @hulumi/policies versions before 1.3.2, which fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can exploit this by using ForAnyValue:StringLike operators to conceal wildcard GitHub Actions OIDC subject conditions from security guardrails. This bypass allows unauthorized principals to assume AWS IAM roles that should be restricted to specific GitHub repositories or workflows. The vulnerability represents a significant risk in CI/CD pipelines that rely on GitHub Actions OIDC federation for AWS access. Organizations using affected versions may unknowingly permit overly broad access to AWS resources. The fix is available in version 1.3.2 of the @hulumi/policies package. This issue is particularly concerning in supply chain and cloud identity contexts where trust policy integrity is critical.
