A critical vulnerability in @hulumi/policies allows unauthenticated attackers to bypass security policy checks by spoofing bucket evidence, potentially leading to unauthorized access to insecure configurations.

This vulnerability is an improper access control flaw (CWE-284) within the policy evaluation logic. An unauthenticated attacker can exploit this by submitting spoofed SecureBucket parent evidence, causing the validator to accept unsafe bucket configurations as secure.

The ability to bypass security policy checks presents a significant risk to data integrity and infrastructure security. By misleading the policy engine, an attacker may force the deployment or retention of insecure bucket configurations, potentially resulting in unauthorized data exposure or non-compliance with organizational security standards. With a CVSS score of 7.5, this high-severity flaw requires immediate remediation to prevent exploitation.

Immediate Action: Upgrade the @hulumi/policies package to version 1.3.2 or later to incorporate the necessary validation fixes.

Proactive Monitoring: Review application logs for anomalous policy evaluation requests or unexpected input patterns related to SecureBucket parent evidence submissions.

Compensating Controls: Implement strict network ingress filtering or use an API gateway to validate the structure of incoming policy requests if immediate patching is not feasible.

Public Exploit Available: No

Given the high CVSS score and the direct impact on security policy enforcement, organizations using the @hulumi/policies package should prioritize this update. Update to version 1.3.2 immediately to ensure that security policy checks cannot be bypassed through evidence spoofing. Failure to patch leaves your cloud storage configurations vulnerable to misconfiguration and unauthorized access.