CVE-2026-82860: Improper Privilege Management in hulumi policies

@hulumi/policies versions prior to 1.3.2 do not fully inspect inline and attached IAM policy evidence when enforcing the administrator-policy guardrail. This improper privilege management vulnerability allows attackers to create policy paths that effectively grant administrative privileges, bypassing the intended policy evaluation controls. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized administrative access by bypassing policy evaluation controls, potentially allowing attackers to perform privileged actions within the affected system. This compromises the confidentiality, integrity, and availability of resources governed by the @hulumi/policies component.

Upgrade to @hulumi/policies version 1.3.2 or later, where this improper privilege management vulnerability has been addressed. No other mitigations are specified. Patch status is confirmed by the affectedVersions field indicating versions before 1.3.2 are vulnerable.