CVE-2026-82856: Improper Access Control in hulumi policies

@hulumi/policies versions prior to 1.3.2 do not correctly validate set-qualified AWS IAM condition operators within GitHub OIDC trust policies. Specifically, attackers can exploit the ForAnyValue:StringLike operator to conceal wildcard GitHub Actions OIDC subject conditions, effectively bypassing security guardrails designed to restrict access. This improper access control flaw can lead to unauthorized access within AWS environments relying on these policies for identity and access management.

The vulnerability allows attackers to bypass security guardrails in AWS IAM trust policies that use GitHub OIDC for authentication. By exploiting the improper validation of condition operators, attackers can hide wildcard subject conditions, potentially gaining unauthorized access to AWS resources. The CVSS 4.0 score of 9.3 indicates a critical severity with network attack vector, no privileges or user interaction required, and high impacts on confidentiality, integrity, and availability.

A patch is available for this vulnerability. Users should upgrade @hulumi/policies to version 1.3.2 or later to ensure proper validation of AWS IAM condition operators in GitHub OIDC trust policies. Since this is a cloud service component, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor advisory for confirmation and apply updates accordingly.