CedarJava has a type confusion vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-843 and the CVSS impact.
Summary
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cedar-policy | cedar-java | before 2.3.6; 3.1.2 to before 3.4.1; 4.0.0 to before 4.9.0 | 2.3.6, 3.4.1, 4.9.0 | Patch available | CNA |
| — | com.cedarpolicy:cedar-java (Maven) | before 2.3.6 | 2.3.6 | Patch available | GHSA-93g4-m6xv-cmvr |
| — | com.cedarpolicy:cedar-java (Maven) | 3.1.2 to before 3.4.1 | 3.4.1 | Patch available | GHSA-93g4-m6xv-cmvr |
| — | com.cedarpolicy:cedar-java (Maven) | 4.0.0 to before 4.9.0 | 4.9.0 | Patch available | GHSA-93g4-m6xv-cmvr |
- cedar-java Vendorcedar-policy Affected before 2.3.6; 3.1.2 to before 3.4.1; 4.0.0 to before 4.9.0 Fixed in 2.3.6, 3.4.1, 4.9.0 Patch available CNA
- com.cedarpolicy:cedar-java (Maven) Vendor— Affected before 2.3.6 Fixed in 2.3.6 Patch available GHSA-93g4-m6xv-cmvr
- com.cedarpolicy:cedar-java (Maven) Vendor— Affected 3.1.2 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-93g4-m6xv-cmvr
- com.cedarpolicy:cedar-java (Maven) Vendor— Affected 4.0.0 to before 4.9.0 Fixed in 4.9.0 Patch available GHSA-93g4-m6xv-cmvr
Remediation
- Fix · CNA cedar-java (cedar-policy) Fixed in 2.3.6, 3.4.1, 4.9.0
- Fix · GHSA-93g4-m6xv-cmvr com.cedarpolicy:cedar-java (Maven) Fixed in 2.3.6 Advisory →
- Fix · GHSA-93g4-m6xv-cmvr com.cedarpolicy:cedar-java (Maven) Fixed in 3.4.1 Advisory →
- Fix · GHSA-93g4-m6xv-cmvr com.cedarpolicy:cedar-java (Maven) Fixed in 4.9.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55772
- 2026-10-03 Alias added: GHSA-93g4-m6xv-cmvr
References
More cedar-policy vulnerabilities
- TI-2026-40262 CedarJava has a policy injection vulnerability CVSS 3.1HIGH 8.8
- TI-2026-40260 CedarJava has policy injection, type confusion, and incorrect equality comparison vulnerabilities CVSS 3.1HIGH 8.8
- TI-2026-36628 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation CVSS 3.1HIGH 8.8
Sources
- CVE-2026-55772 · CVE Program
- CVE-2026-55772 · NVD
- FIRST EPSS
- GHSA-93g4-m6xv-cmvr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences