CVE-2026-82856
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Aug 31, 2026
Vendor
unknown
Description
@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.