---
id: CVE-2026-82855
title: >-
  @hulumi/policies versions before 1.3.2 contain an evidence validation bypass
  vulnerability in Cloudflare and deployment-governance validators that allows
  attackers to suppress violations by submitting unrelated compliant evidence
summary: >-
  @hulumi/policies versions before 1.3.2 contain an evidence validation bypass
  vulnerability in Cloudflare and deployment-governance validators that allows
  attackers to suppress violations by submitting unrelated compliant evidence.
  Attack…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-693
vendor: hulumi
product: policies
affected:
  - policies < 1.3.2
published: '2026-08-31'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:17:51.390'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82855'
references:
  - url: >-
      https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-59f3-7227-wmh4
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-evidence-validation-bypass
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-31T14:40:23.750531Z'
epss: 0.00587
epssPercentile: 0.46361
ingestedAt: '2026-10-08T16:52:14.735Z'
---

## Overview

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.