Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @hulumi/policies | npm | < 1.4.0 | 1.4.0 |
Miggo AIRoot Cause AnalysisThe vulnerability GHSA-9vc9-4jv3-rf86 in @hulumi/policies is a high-severity improper access control issue. The root cause is twofold, primarily affecting the HULUMI-H5 policy for S3 bucket hardening but also present in several other policy packs.
First, multiple policies used an insecure method to verify the parent-child relationship between resources. They relied on a simple substring check (urn.includes("<parent-type>$")) on the Pulumi resource URN. Since the logical name portion of a URN is user-controllable, an attacker could create a resource with a specially crafted logical name that contained the parent type string. This would spoof the ancestry and bypass policies that granted exemptions to resources managed by a specific parent component. This affected not only the main H5 policy but also policies in the Cloudflare, GitHub, and CIS packs.
Second, specific to the HULUMI-H5 policy (h5SecureBucketExemptionRequiresHardening.validateStack), there was a lack of value-binding. The policy was intended to ensure that any raw S3 bucket exempted from the H1 policy (by being a child of a SecureBucket component) was accompanied by five specific hardening resources (e.g., Public Access Block, SSE). The vulnerable implementation correctly checked for the existence of these five sibling resources under the same parent, but it failed to verify that those resources were actually configured to apply to the exempted bucket. An attacker could therefore create a SecureBucket with a raw, unhardened S3 bucket and five 'decoy' hardening resources that pointed to a completely different, unrelated bucket. The H5 policy would pass, leaving the target bucket exposed without any of the required security controls.
The patch addresses these issues by:
isUrnChildOfComponent, urnsShareParentComponent) that correctly validates ancestry by looking only at the type-chain portion of the URN, ignoring the user-controllable logical name.h5SecureBucketExemptionRequiresHardening policy. The updated logic now verifies that the bucket property of each hardening resource (and the Resource ARN in the bucket policy) explicitly references the exempted bucket.h5SecureBucketExemptionRequiresHardening.validateStackpackages/policies/src/aws/hulumi-hardening-pack.ts
isChildOfpackages/policies/src/cloudflare/hulumi-hardening-pack.ts
isChildOfSecureRepositorypackages/policies/src/github/hulumi-hardening-pack.rules.ts
isChildOfOrgFoundationpackages/policies/src/github/hulumi-hardening-pack.rules.ts
isChildOfpackages/policies/src/platform/deployment-governance-pack.ts
cis_2_1_1_ssePresent.validateResourcepackages/policies/src/aws/cis-v5-pack.rules.ts
cis_2_1_5_tlsOnly.validateResourcepackages/policies/src/aws/cis-v5-pack.rules.ts