The vulnerability is an evidence validation bypass that appears in Cloudflare and deployment-governance validators of @hulumi/policies before version 1.3.2. Attackers can submit evidence that is unrelated to the target resource, thereby suppressing violations and making the resource appear compliant when it is not. This flaw is a classic configuration or security attribute error (CWE-693) that undermines the enforcement of security guardrails, potentially allowing unauthorized configuration changes or access to resources that should remain restricted.

The affected product is @hulumi/policies from the vendor hulumi. All releases of the policies package before version 1.3.2 are vulnerable. No additional sub‑version details are given by the CNA; any deployment using a pre‑1.3.2 version may be impacted.

The CVSS score of 9.3 indicates a critical level of risk, and while the EPSS score is not available, the lack of a KEV listing suggests that exploitation is not yet widespread or documented. The attack likely requires the ability to submit evidence to the governing validators, which could be achieved by users with write access to the policy management interface or by compromising a client that submits evidence. Once an attacker can supply evidence from any zone, hostname, origin, or repository, they can bypass security guardrails for unrelated resources in the same stack, potentially enabling a range of misconfigurations and unauthorized resource deployments.