Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @hulumi/policies | npm | < 1.4.0 | 1.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in how the @hulumi/policies package handles AWS IAM trust policies where the Principal.Federated field is an array of OIDC providers. The core of the issue is in commit 977bba0a71c52ba9027af69a63e47ad6205be230.
The analysis of the patch reveals that the functions G_OIDC_1.validateResource (via its helper inspectAwsIamTrustPolicy) and trustPolicyTrustsGithubOidc were converting the Principal.Federated array into a string using String(). This resulted in a comma-separated list of providers.
The federatedIsGithubOidc function, which was supposed to check for the presence of the GitHub OIDC provider, was only designed to handle a single string. When passed the comma-separated string, it would only inspect the first provider, leading to a bypass if the GitHub provider was not the first element in the array.
The fix involved modifying federatedIsGithubOidc to accept an unknown type, check if it's an array, and if so, iterate through each element to check for the GitHub OIDC provider. The calling functions were also updated to pass the principal.Federated value directly without the String() conversion. The identified vulnerable functions are the ones that participated in this flawed logic, leading to the policy bypass.
G_OIDC_1.validateResourcepackages/policies/src/github/g-oidc-1.ts
trustPolicyTrustsGithubOidcpackages/policies/src/github/g-oidc-2.ts
federatedIsGithubOidcpackages/policies/src/github/github-oidc-issuer.ts