Vulnerability Bulletins |
CVE-2026-82856 |
|
| Affected software | AWS |
| @hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-82856 | |