CVE-2026-55772
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
CedarJava prior to versions 2.3.6, 3.4.1 and 4.9.0 contains a vulnerability where improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.
Risk Assessment
An attacker controlling keys in input data could cause misinterpretation of data, leading to unauthorized access.
Recommendation
Upgrade CedarJava to version 2.3.6, 3.4.1, 4.9.0 or later.
Other vulnerabilities in CedarJava
See all- CVE-2026-55773High
In CedarJava library versions prior to 2.3.6, 3.4.1, and 4.9.0, a vulnerability allows Cedar-expression injection due to improper input handling. The toCedarExpr() method does not escape special characters, enabling injection of arbitrary policy expressions.
- CVE-2026-55771High
In CedarJava versions prior to 4.9.0, the EntityIdentifier.equals() method has inverted logic for null and self-reference checks, causing incorrect equality comparisons. This does not affect Cedar authorization decisions but may impact integrators performing their own entity identifier comparisons.
Original NVD description (English source)
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.