CVE-2026-82855: Protection Mechanism Failure in hulumi policies

@hulumi/policies versions prior to 1.3.2 contain an evidence validation bypass vulnerability affecting Cloudflare and deployment-governance validators. Attackers can submit compliant evidence unrelated to the targeted resource—such as from different zones, hostnames, origins, or repositories—to suppress violations and bypass security guardrails within the same stack. This flaw compromises the integrity of policy enforcement by allowing invalid evidence to be accepted, undermining security controls. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. The vendor provides a patch in version 1.3.2, and as this is a cloud-hosted service, remediation is managed by the vendor.

Attackers can bypass security guardrails by submitting unrelated compliant evidence, allowing suppression of violations in Cloudflare and deployment-governance validators. This compromises the enforcement of security policies and may lead to unauthorized or insecure configurations being accepted within the same stack. The vulnerability affects the integrity of policy validation and can result in significant security risks.

A patch is available in @hulumi/policies version 1.3.2. Since this is a cloud-hosted service, the vendor manages remediation server-side. Users should verify that their environment is updated to version 1.3.2 or later and consult the vendor advisory for confirmation of remediation status.