CVE-2026-82856: Critical GitHub Actions OIDC Policy Bypass in @hulumi/policies — Detection and Remediation Guide | Security Arsenal

NVD has published CVE-2026-82856, a CVSS 9.8 (Critical), network-exploitable vulnerability affecting the @hulumi/policies package — a policy-as-code guardrail library commonly used to validate AWS IAM configurations in CI/CD pipelines. Versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. The practical impact: an attacker (or a careless developer) can craft a trust policy using ForAnyValue:StringLike that contains a wildcard GitHub Actions OIDC subject — and the policy validation layer that organizations rely on to catch exactly this misconfiguration will silently pass it.

This is a supply-chain guardrail bypass with direct cloud impact. GitHub Actions OIDC federation is the recommended pattern for keyless AWS authentication in CI/CD — but it is only as safe as the sub condition in the role trust policy. A wildcard or overly broad subject means any GitHub repository, branch, or workflow matching the loose pattern can assume your AWS role. If that role has production privileges, you have a remote, unauthenticated path from a malicious GitHub workflow to your cloud control plane. Defenders need to upgrade the package and — critically — audit existing trust policies, because policies written while the vulnerable validator was in place may already be live in AWS.

Technical Analysis

Affected Products and Versions

Item	Detail
CVE	CVE-2026-82856
CVSS	9.8 (Critical), vector pathway: NETWORK
Affected package	`@hulumi/policies` (npm)
Affected versions	All versions before 1.3.2
Fixed version	1.3.2 and later
Impact surface	AWS IAM role trust policies for GitHub Actions OIDC (`token.actions.githubusercontent.com`) validated through this library
Advisory	https://nvd.nist.gov/vuln/detail/CVE-2026-82856

How the Vulnerability Works

AWS IAM condition operators can be prefixed with set qualifiers — ForAnyValue: and ForAllValues: — which change evaluation semantics when a condition key resolves to multiple values. In a GitHub Actions OIDC trust policy, the critical control is the condition on token.actions.githubusercontent.com:sub, which should pin the role to a specific repository and ref, for example:

JSON

"Condition": {
  "StringEquals": {
    "token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
    "token.actions.githubusercontent.com:sub": "repo:my-org/my-repo:ref:refs/heads/main"
  }
}

The vulnerability is a validation logic gap: @hulumi/policies versions prior to 1.3.2 inspected standard operators like StringEquals and StringLike for dangerous wildcards in the subject claim, but did not apply the same checks to set-qualified variants. An attacker can therefore smuggle a wildcard past the guardrail:

JSON

"Condition": {
  "ForAnyValue:StringLike": {
    "token.actions.githubusercontent.com:sub": "repo:*"
  }
}

From a defender's perspective, the attack chain is:

Policy authored or modified — a developer with pipeline access, a compromised dependency, or a malicious pull request introduces a trust policy using ForAnyValue:StringLike with a wildcard sub.
Guardrail bypass — the vulnerable @hulumi/policies validation passes the policy as compliant. Code review tooling and automated checks that depend on the library show green.
Role deployment — the trust policy is applied to an AWS IAM role via UpdateAssumeRolePolicy or infrastructure-as-code deployment.
Cross-repository role assumption — any GitHub Actions workflow in any repository matching the wildcard (potentially repo:*, i.e., any repo in the world if combined with a permissive aud) can mint an OIDC token and call sts:AssumeRoleWithWebIdentity, inheriting the role's AWS permissions.

Exploitation requires no AWS credentials — only the ability to run a workflow in a GitHub repository that matches the wildcard pattern. That is what drives the NETWORK attack vector and the 9.8 score.

Exploitation Status

At time of writing, CVE-2026-82856 is newly published on NVD and has not been added to the CISA Known Exploited Vulnerabilities catalog, and no public in-the-wild exploitation has been confirmed. However, the technique is trivial to execute once understood, requires no exploit code, and the vulnerable pattern may already exist in production trust policies — either through attacker action or accidental misconfiguration that the broken validator failed to catch. Treat audit and remediation as urgent: the exposure window is every pipeline that validated policies with a pre-1.3.2 version of the library.

Detection & Response

Detection here operates on three planes: AWS CloudTrail (trust policy modifications and OIDC role assumptions), code/pipeline telemetry (the vulnerable package version in builds), and endpoint forensics (trust policy artifacts on developer workstations and runners).

SIGMA Rules

YAML

---
title: GitHub OIDC Trust Policy Modified with Set-Qualified Wildcard Subject
id: 3f8a1c94-7d2e-4b51-9a06-cve202682856
status: experimental
description: Detects AWS IAM role trust policy updates that introduce set-qualified condition operators (ForAnyValue/ForAllValues with StringLike) referencing the GitHub Actions OIDC subject claim, consistent with CVE-2026-82856 guardrail bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82856
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1078.004
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event:
    eventSource: iam.amazonaws.com
    eventName:
      - UpdateAssumeRolePolicy
      - CreateRole
  selection_content:
    requestParameters|contains:
      - 'ForAnyValue:StringLike'
      - 'ForAllValues:StringLike'
  selection_oidc:
    requestParameters|contains: 'token.actions.githubusercontent.com:sub'
  condition: selection_event and selection_content and selection_oidc
falsepositives:
  - Rare legitimate use of set operators on GitHub OIDC subjects; review all hits
level: high
---
title: Wildcard Subject in GitHub Actions OIDC Role Trust Policy
id: 9c2e5b71-4a68-4f03-8d17-cve202682857
status: experimental
description: Detects creation or modification of AWS IAM role trust policies for GitHub Actions OIDC where the subject condition contains a wildcard, allowing cross-repository role assumption.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82856
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1098
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_event:
    eventSource: iam.amazonaws.com
    eventName:
      - UpdateAssumeRolePolicy
      - CreateRole
  selection_wildcard:
    requestParameters|contains:
      - 'repo:*'
      - 'repo:*'
      - ':sub": "*'
  selection_provider:
    requestParameters|contains: 'token.actions.githubusercontent.com'
  condition: selection_event and selection_wildcard and selection_provider
falsepositives:
  - Deliberately permissive sandbox roles (should be remediated, not whitelisted)
level: critical
---
title: Vulnerable hulumi-policies Version Executed in CI Pipeline
id: 61b7d3e8-2f49-4c15-a902-cve202682858
status: experimental
description: Detects installation or execution of @hulumi/policies versions prior to 1.3.2 in build environments, indicating policy validation that cannot be trusted for GitHub OIDC trust policy checks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-82856
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_npm:
    Image|endswith:
      - '/npm'
      - '/npx'
      - '/node'
  selection_pkg:
    CommandLine|contains: '@hulumi/policies'
  selection_vuln_version:
    CommandLine|contains:
      - '@1.0.'
      - '@1.1.'
      - '@1.2.'
      - '@1.3.0'
      - '@1.3.1'
  condition: selection_npm and selection_pkg and selection_vuln_version
falsepositives:
  - None expected; pinning a known-vulnerable version is itself a finding
level: medium

KQL (Microsoft Sentinel)

Hunt AWS CloudTrail (ingested via the AWS connector) for OIDC trust policy changes and anomalous role assumptions via GitHub Actions web identity tokens:

KQL — Microsoft Sentinel / Defender

// Hunt: GitHub OIDC trust policy tampering and wildcard subject conditions
// Tables: AWSCloudTrail (Sentinel AWS connector) — fall back to CommonSecurityLog if parsing via CEF
let timeframe = 14d;
AWSCloudTrail
| where TimeGenerated > ago(timeframe)
| where EventSource == "iam.amazonaws.com"
| where EventName in ("UpdateAssumeRolePolicy", "CreateRole")
| where RequestParameters has "token.actions.githubusercontent.com"
| extend SetOperatorBypass = RequestParameters has_any ("ForAnyValue:StringLike", "ForAllValues:StringLike")
| extend WildcardSubject = RequestParameters has_any ("repo:*", "repo:", "repo:*")
| where SetOperatorBypass or WildcardSubject
| project TimeGenerated, UserIdentityArn, SourceIpAddress, UserAgent, EventName,
          RoleName = tostring(parse_json(RequestParameters).roleName),
          SetOperatorBypass, WildcardSubject, RequestParameters
| order by TimeGenerated desc
;
// Correlate: sts:AssumeRoleWithWebIdentity calls for GitHub OIDC roles from unexpected sessions
AWSCloudTrail
| where TimeGenerated > ago(timeframe)
| where EventSource == "sts.amazonaws.com"
| where EventName == "AssumeRoleWithWebIdentity"
| where RequestParameters has "token.actions.githubusercontent.com" or UserAgent has "github-actions"
| summarize AssumptionCount = count(), distinctRepos = dcount(tostring(parse_json(UserIdentityPrincipalId)))
  by RoleSessionName = tostring(parse_json(ResponseElements).assumedRoleUser.arn), SourceIpAddress
| where AssumptionCount > 50 or distinctRepos > 3
| order by distinctRepos desc

Velociraptor VQL

Hunt developer workstations and self-hosted runners for GitHub OIDC trust policy artifacts containing wildcard or set-qualified subject conditions:

VQL — Velociraptor

-- Hunt for GitHub OIDC trust policy files with wildcard or set-qualified subjects
SELECT FullPath, Size, Mtime,
       read_file(filename=FullPath, length=4096) AS ContentPreview
FROM glob(globs=[
  'C:/Users/*/**/trust-policy*.json',
  'C:/Users/*/**/oidc*.json',
  '/home/*/**/trust-policy*.json',
  '/home/*/**/oidc*.json',
  '/opt/actions-runner/**/trust-policy*.json',
  '/home/*/**/policies/**/*.ts',
  '/home/*/**/policies/**/*.js'
])
WHERE ContentPreview =~ 'token.actions.githubusercontent.com'
  AND (ContentPreview =~ 'ForAnyValue:StringLike'
    OR ContentPreview =~ 'ForAllValues:StringLike'
    OR ContentPreview =~ 'repo:\\*')

Remediation & Audit Script

Bash / Shell

#!/bin/bash
# CVE-2026-82856 — Audit & remediation helper
# 1) Verify @hulumi/policies version in the repo
# 2) Enumerate AWS IAM roles with GitHub OIDC trust and flag dangerous subjects
set -euo pipefail

# --- Step 1: Check for vulnerable package versions ---
echo "=== Checking @hulumi/policies version ==="
if [ -f package-lock.json ]; then
  grep -E '"@hulumi/policies"' package-lock.json || echo "Package not found in lockfile"
fi
npm ls @hulumi/policies 2>/dev/null || true
echo "REQUIRED: @hulumi/policies >= 1.3.2 — upgrade with:"
echo "  npm install @hulumi/policies@latest"

# --- Step 2: Audit AWS IAM roles for GitHub OIDC trust with wildcard subjects ---
echo ""
echo "=== Auditing IAM role trust policies for GitHub OIDC wildcards ==="
for role in $(aws iam list-roles --query 'Roles[].RoleName' --output text); do
  trust=$(aws iam get-role --role-name "$role" \
    --query 'Role.AssumeRolePolicyDocument' --output json 2>/dev/null || continue)
  if echo "$trust" | grep -q "token.actions.githubusercontent.com"; then
    if echo "$trust" | grep -qE 'ForAnyValue:StringLike|ForAllValues:StringLike|repo:\*'; then
      echo "[ALERT] Role: $role"
      echo "$trust" | grep -E 'StringLike|sub|repo' || true
      echo "---"
    else
      echo "[OK]    Role: $role (GitHub OIDC, no wildcard/set-operator subject detected)"
    fi
  fi
done

echo ""
echo "=== Review any [ALERT] roles immediately ==="
echo "Replace wildcard subjects with pinned form:"
echo '  "repo:ORG/REPO:ref:refs/heads/main" (or environment:/pull_request as appropriate)'

Remediation

Upgrade @hulumi/policies to 1.3.2 or later in every repository and pipeline that uses it. Pin the version in package.json and regenerate lockfiles. Run npm audit across your organization to locate all consumers.
Audit every existing IAM role with a GitHub OIDC trust relationship (token.actions.githubusercontent.com). The vulnerable validator means previously "approved" policies cannot be trusted. Use the script above and flag any trust policy containing ForAnyValue:StringLike, ForAllValues:StringLike, or a sub value of repo:* or similar wildcards.
Pin subjects explicitly. Every GitHub OIDC trust policy should scope sub to repo:ORG/REPO:ref:refs/heads/BRANCH (or environment:NAME / pull_request where genuinely required). Always condition aud on sts.amazonaws.com. Avoid StringLike on sub unless a reviewed, bounded pattern is unavoidable.
Review CloudTrail history for UpdateAssumeRolePolicy and CreateRole events touching OIDC roles over the exposure window, and hunt AssumeRoleWithWebIdentity for anomalous assumption volume or unexpected repository identities.
Add compensating guardrails that do not depend on the vulnerable library: AWS Config custom rules or IAM Access Analyzer policy checks that fail any role trust policy with wildcard OIDC subjects, enforced at the organization level via SCPs where possible.
Restrict who can modify trust policies. Tighten IAM permissions on iam:UpdateAssumeRolePolicy and require change control for OIDC role definitions in your IaC repositories — a guardrail bypass is only exploitable if the poisoned policy gets deployed.

Official references: NVD — CVE-2026-82856. Monitor the CISA KEV catalog; at publication this CVE is not listed, but given the trivial exploitation path, do not wait for KEV inclusion to act.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

CVE-2026-82856: Critical GitHub Actions OIDC Policy Bypass in @hulumi/policies — Detection and Remediation Guide