Summary
@hulumi/policies bypasses IAM-role policy checks when the role trusts multiple OIDC providers
Affected: @hulumi/policies < 1.4.0, Fixed in: 1.4.0, Severity: High, CWE-697 (Incorrect Comparison)
AWS IAM trust policies can list more than one federated identity provider, for example, a role that accepts BOTH GitHub Actions OIDC and Google's OIDC. The G_OIDC_1 and G_OIDC_2 policy rules are supposed to flag IAM roles whose GitHub-OIDC trust is too permissive (e.g. wildcard sub: conditions that would let any branch or any pull request assume the role).
The bug: when the role's Principal.Federated field was a JSON array of multiple providers, the rules failed to recognise that GitHub Actions was one of them. The providers list was coerced into a single comma-joined string, the matcher only looked at the start, and the GitHub OIDC hostname was lost in the join. Both rules concluded "this isn't a GitHub-OIDC role" and skipped the wildcard check.
Workarounds
None reliable, upgrade is the fix.
Resources
- PR #178 (Cluster A); regression tests at
packages/policies/tests/github/{g-oidc-2,github-oidc-issuer}.test.ts.
Impact
A trust policy that listed the real GitHub OIDC provider ARN alongside any second provider would slip past both detectors. Consumers using HulumiHardeningPack or HulumiGithubHardeningPack could ship an IAM role with wildcard sub: conditions (allowing untrusted PRs from forks to assume the role) while their policy validation reported the stack as compliant. The G_OIDC_2 detector also failed to mark such roles for the cluster-admin / AdministratorAccess blast-radius check.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Upgrade to @hulumi/[email protected]. The shared GitHub-OIDC-provider matcher now correctly walks lists of providers, if any element of the list is the real GitHub OIDC ARN, the role is treated as GitHub-OIDC-assumable and the wildcard / blast-radius checks apply.
Frequently Asked Questions
- What is CVE-2026-48032? CVE-2026-48032 is a high-severity security vulnerability in @hulumi/policies (npm), affecting versions < 1.4.0. It is fixed in 1.4.0.
- Which versions of @hulumi/policies are affected by CVE-2026-48032? @hulumi/policies (npm) versions < 1.4.0 is affected.
- Is there a fix for CVE-2026-48032? Yes. CVE-2026-48032 is fixed in 1.4.0. Upgrade to this version or later.
- Is CVE-2026-48032 exploitable, and should I be worried? Whether CVE-2026-48032 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-48032 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-48032? Upgrade
@hulumi/policiesto 1.4.0 or later.