CyberRota Analysis
AI-GeneratedVersions of @hulumi/policies prior to 1.3.2 are vulnerable to an evidence validation bypass, enabling attackers to circumvent security measures by submitting compliant evidence from unrelated resources. This critical vulnerability can lead to unauthorized access and manipulation of deployment governance, posing significant risks to cloud security. Organizations utilizing this package should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.