Description

@hulumi/policies versions before 1.3.2 fail to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-31T09:17:05.780Z",
  "pubdate": "2026-08-31T09:17:05.780Z",
  "executiveSummary": "A critical validation vulnerability exists in @hulumi/policies versions prior to 1.3.2, specifically concerning the handling of set-qualified AWS IAM condition operators within GitHub OIDC trust policies.\nThe vulnerability is categorized as an improper input validation flaw that allows attackers to bypass security guardrails intended to enforce strict GitHub Actions OIDC subject constraints.\nBy manipulating the condition operator logic, an attacker can conceal wildcard-based OIDC subject conditions from automated security scanning or policy enforcement mechanisms.\nThis creates an opportunity for unauthorized entities or workflows to assume AWS IAM roles that should have been restricted to specific, trusted repositories or branches.\nThe risk is significant for organizations relying on these policies to govern cross-account or cross-repository access, as it enables privilege escalation via misconfigured trust relationships.\nExploitation requires the attacker to be capable of submitting or modifying GitHub Actions OIDC configurations governed by the vulnerable policy definition files.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient parsing and validation logic within @hulumi/policies when processing set-qualified AWS IAM condition operators, specifically 'ForAnyValue:StringLike'.\nIn the context of AWS IAM trust policies for GitHub OIDC, security guardrails often inspect the 'Condition' block to ensure that 'sub' (subject) claims match strict patterns to prevent unauthorized workflows from assuming roles.\nThe library fails to correctly normalize or analyze the set-based behavior of 'ForAnyValue:StringLike'. Because 'ForAnyValue' allows a condition to return true if any element of the evaluated set matches the pattern, an attacker can inject broad wildcard expressions into the policy.\nThe exploitation flow proceeds as follows: First, the attacker identifies a role managed by @hulumi/policies where the guardrails perform static analysis or validation on the OIDC provider's subject claim.\nSecond, the attacker crafts a malicious OIDC subject condition utilizing 'ForAnyValue:StringLike' combined with broad wildcards (e.g., 'repo:attacker/repo:*').\nThird, because the library's validation logic does not properly account for the set-operator semantics, it fails to flag these wildcard patterns as violations of the security policy, effectively bypassing the intended guardrail.\nFinally, when the policy is deployed to AWS, the IAM service interprets the 'ForAnyValue' condition correctly, allowing the attacker's workflow—which matches the broad wildcard—to successfully assume the IAM role.\nThis allows for post-exploitation lateral movement or privilege escalation within the AWS environment, as the attacker effectively masks their identity or scope under the guise of an ostensibly restricted policy.\nThis vulnerability is restricted to environments utilizing versions of @hulumi/policies before 1.3.2. It is an implementation flaw within the policy-as-code evaluation layer rather than an inherent weakness in the AWS IAM service itself."
}