Read the docs

cedar-policy

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

cedar-policy records in CISA KEV

No cedar-policy vulnerabilities are listed in CISA KEV.

Records

4 records

TI-2026-40262 CVE-2026-55773 · GHSA-qmch-v2q9-wg4p

CedarJava has a policy injection vulnerability

Priority MEDIUM 41

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00518 Published 2026-07-13 Fixed in 2.3.6, 3.4.1 +1 CWE-94
TI-2026-40261 CVE-2026-55772 · GHSA-93g4-m6xv-cmvr

CedarJava has a type confusion vulnerability

Priority MEDIUM 41

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00479 Published 2026-07-13 Fixed in 2.3.6, 3.4.1 +1 CWE-843
TI-2026-36628 CVE-2026-49473 · GHSA-g4w6-vmgf-xqvx

@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

Priority MEDIUM 40

@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization polic…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00469 Published 2026-08-12 Fixed in 0.3.0 CWE-436
Open these records in search →