GHSA-g759-4pxw-6692
NoneCVSS
—
EPSS
—
Published
Jun 10, 2026
CISA due date
—
The record
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @hulumi/policies | 0 | 1.4.0 |
Related vulnerabilities
- GHSA-9vc9-4jv3-rf86 @hulumi/policies has a HULUMI-H5 bypass via decoy sibling resources targeting a different… Also affects @hulumi/policies
- GHSA-rhgj-6g2c-frmm @hulumi/policies bypasses policy packs with a forged Pulumi-URN logical name Also affects @hulumi/policies
- GHSA-59f3-7227-wmh4 @hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance… Also affects @hulumi/policies
- GHSA-q2f7-m237-v562 @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition… Also affects @hulumi/policies
- GHSA-4xrh-5m3m-328w @hulumi/policies: CIS 1.16 admin policy bypass for inline and attached IAM policies Also affects @hulumi/policies
- GHSA-g43v-9x7q-83pq @hulumi/policies: HULUMI-H1 SecureBucket parent spoof bypass Also affects @hulumi/policies
- CVE-2026-101913 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697
- CVE-2026-101912 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in… CWE-697