CVE-2026-82860
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Aug 31, 2026
Vendor
unknown
Description
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.