CVE-2026-55771
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In CedarJava versions prior to 4.9.0, the EntityIdentifier.equals() method has inverted logic for null and self-reference checks, causing incorrect equality comparisons. This does not affect Cedar authorization decisions but may impact integrators performing their own entity identifier comparisons.
Risk Assessment
Organizations using custom entity identifier comparisons may receive incorrect results, potentially leading to flawed business logic or access management errors.
Recommendation
Immediately upgrade CedarJava to version 4.9.0 or later, which fixes the inverted logic in the EntityIdentifier.equals() method.
Other vulnerabilities in CedarJava
See all- CVE-2026-55773High
In CedarJava library versions prior to 2.3.6, 3.4.1, and 4.9.0, a vulnerability allows Cedar-expression injection due to improper input handling. The toCedarExpr() method does not escape special characters, enabling injection of arbitrary policy expressions.
- CVE-2026-55772High
CedarJava prior to versions 2.3.6, 3.4.1 and 4.9.0 contains a vulnerability where improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.
Original NVD description (English source)
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect equality comparisons. The EntityIdentifier.equals() method has inverted logic for null and self-reference checks, returning true for null comparisons and false for self-comparisons. This does not affect Cedar authorization decisions (computed in Rust from JSON), but could affect integrators who perform their own equality checks on entity identifiers. This issue has been fixed in version 4.9.0.