GHSA-4xrh-5m3m-328w
NoneCVSS
—
EPSS
—
Published
May 21, 2026
CISA due date
—
The record
@hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @hulumi/policies | 0 | 1.3.2 |
Related vulnerabilities
- GHSA-9vc9-4jv3-rf86 @hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different… Also affects @hulumi/policies
- GHSA-rhgj-6g2c-frmm @hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name Also affects @hulumi/policies
- GHSA-g759-4pxw-6692 @hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC… Also affects @hulumi/policies
- GHSA-59f3-7227-wmh4 @hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance… Also affects @hulumi/policies
- GHSA-q2f7-m237-v562 @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition… Also affects @hulumi/policies
- GHSA-g43v-9x7q-83pq @hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass Also affects @hulumi/policies
- CVE-2026-114658 Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability… CWE-269
- CVE-2026-53614 util-linux is a random collection of Linux utilities. CWE-269