What is CVE-2026-82855?

CVE-2026-82855 is a critical-severity vulnerability in Hulumi Policies, classified under Protection Mechanism Failure. CVSS score: 9.8/10. Published 2026-08-31.

How severe is CVE-2026-82855?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Hulumi Policies

CVE-2026-82855

@hulumi/policies versions before 1.3.2 contain an evidence validation bypass vulnerability in Cloudflare and deployment-governance validators that allows attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.

EPSS: 0.003 (25.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Hulumi Policies

Weakness classification (CWE)

CWE-693 — Protection Mechanism Failure

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-82855?: CVE-2026-82855 is a critical-severity vulnerability in Hulumi Policies, classified under Protection Mechanism Failure. CVSS score: 9.8/10. Published 2026-08-31.
How severe is CVE-2026-82855?: Critical severity. CVSS v3 base score is 9.8 out of 10.