An unauthenticated security bypass vulnerability in the hulumi policies package allows attackers to circumvent AWS IAM condition guardrails, posing a critical risk to cloud infrastructure security.

The vulnerability is an improper access control flaw (CWE-284) where the software fails to validate set-qualified AWS IAM condition operators. An unauthenticated attacker can exploit this by using ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from organizational security guardrails.

The ability to bypass IAM condition guardrails allows an attacker to gain unauthorized permissions or escalate privileges within an AWS environment by masking malicious OIDC subject conditions. Given the CVSS score of 9.8, this vulnerability represents a critical risk that could lead to full compromise of cloud resources, data exfiltration, or total loss of integrity in trust relationships.

Immediate Action: Update the @hulumi/policies package to version 1.3.2 or later immediately to ensure proper validation of IAM condition operators.

Proactive Monitoring: Review AWS CloudTrail logs and OIDC trust policy configurations for any unexpected use of ForAnyValue:StringLike operators or unusual wildcard subject patterns.

Compensating Controls: Implement strict Service Control Policies (SCPs) in AWS to restrict the creation or modification of IAM roles that rely on OIDC providers until the underlying library can be patched.

Public Exploit Available: exploit_available (unknown)

This vulnerability is critical due to its potential to undermine the foundational security of AWS OIDC trust relationships. Organizations utilizing @hulumi/policies must prioritize the update to version 1.3.2 to prevent unauthorized IAM configuration changes. Failure to remediate this flaw leaves cloud environments exposed to sophisticated privilege escalation techniques that bypass standard security guardrails.