@hulumi/policies versions prior to 1.3.2 allow attackers to construct opaque GitHub OIDC trust policies that bypass expected validation. By using ForAnyValue:StringLike operators, an adversary can conceal wildcard subject conditions, effectively hiding malicious actions from security guardrails. This flaw can lead to elevated privileges within GitHub Actions environments.

The vulnerability affects the hulumi:policies package, specifically all releases before 1.3.2. Users deploying earlier versions should review their policy definitions for any unintended wildcard use.

The CVSS score is 9.3, indicating critical severity, while no EPSS score is available and the vulnerability is not listed in CISA KEV. Exploitation requires the ability to influence the composition of OIDC trust policies; attackers can insert ForAnyValue:StringLike operators to obfuscate subject conditions, thereby bypassing authentication checks. The risk is high for any environment utilizing unsupported hulumi:policies deployments with permissive OIDC policies.