CVE-2026-82861

Katalog CVE

CVSS 7.5 · High EPSS 0,43%

Kerentanan Improper Access Control. Skor CVSS 3.1 7.5 (High) menurut vulncheck.com.

Deskripsi (NVD)

@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoofed SecureBucket parent evidence during policy evaluation. Attackers can bypass security policy checks by providing falsified evidence, causing the validator to miss unsafe bucket configurations.

Rincian

Terbit di NVD

31 Agustus 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Deferred

CVSS 3.1

7.5 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 35,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-g43v-9x7q-83pq
• https://www.vulncheck.com/advisories/hulumi-policies-before-1.3.2-securebucket-parent-spoof-bypass