CyberRota Analysis
AI-GeneratedVersions of @hulumi/policies prior to 1.3.2 are vulnerable to a critical security flaw that allows attackers to create admin-equivalent policy paths, circumventing the intended policy evaluation controls. This could lead to unauthorized access and manipulation of resources, posing significant risks to cloud environments. Organizations utilizing affected versions should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.