---
title: "GHSA-q2f7-m237-v562: @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators"
url: https://erroneo.us/security/ghsa/GHSA-q2f7-m237-v562/
description: "GHSA-q2f7-m237-v562 (critical, npm): @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators. Impact: @hulumi/policies…"
type: advisory
section: "Security Digest"
date_published: 2026-05-21
date_modified: 2026-05-21
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-q2f7-m237-v562"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-q2f7-m237-v562: @hulumi/policies: GitHub OIDC trust policy bypass via AWS set-qualified condition operators

## Affected packages

- npm `@hulumi/policies` < 1.3.2 → fixed: 1.3.2

## Details

Impact: @hulumi/policies versions before 1.3.2 only checked exact AWS IAM StringLike/StringEquals condition operator keys in GOIDC1. Set-qualified operators such as ForAnyValue:StringLike could hide wildcard GitHub Actions OIDC sub conditions from the mandatory guardrail. Patched in 1.3.2: the AWS trust-policy inspector now evaluates set-qualified string operators and rejects unsafe GitHub OIDC sub conditions. Remediation: upgrade @hulumi/policies to 1.3.2 or later.

## Sources

- [GitHub Advisory GHSA-q2f7-m237-v562](https://github.com/advisories/GHSA-q2f7-m237-v562)
- [github.com](https://github.com/kerberosmansour/hulumi/security/advisories/GHSA-q2f7-m237-v562)

---
Source page: https://erroneo.us/security/ghsa/GHSA-q2f7-m237-v562/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt