Is CVE-2026-82860 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82860?

CVE-2026-82860 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-82860

Description

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.