@hulumi/policies: Stack-wide evidence bypassed Cloudflare and deployment-governance guardrails
Date: 2026-05
Affected: npm/@hulumi/policies
Attack vector: other
Category: vulnerability-disclosure
Severity: High
CWE: CWE-693

Impact: @hulumi/policies versions before 1.3.2 used stack-wide evidence shortcuts in several Cloudflare and deployment-governance validators. Unrelated compliant-looking evidence could suppress violations for different zones, hostnames, origins, or repositories in the same stack. Patched in 1.3.2: validators now correlate evidence to the specific protected resource and include regression coverage for unrelated-evidence bypasses. Remediation: upgrade @hulumi/policies to 1.3.2 or later.


Mitigations:

Architectural layers (MAESTRO):