cedar-policy CedarJava up to 2.3.5/3.4.0/4.8.x type confusion

Summaryinfo

A vulnerability classified as critical was found in cedar-policy CedarJava up to 2.3.5/3.4.0/4.8.x. The impacted element is an unknown function. Executing a manipulation can lead to type confusion. The identification of this vulnerability is CVE-2026-55772. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical was found in cedar-policy CedarJava up to 2.3.5/3.4.0/4.8.x. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a type confusion vulnerability. The CWE definition for the vulnerability is CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.

The advisory is available at github.com. This vulnerability was named CVE-2026-55772 since 06/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 2.3.6, 3.4.1 or 4.9.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• cedar-policy

Name

• CedarJava

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 3.0
• 3.1
• 3.2
• 3.3
• 3.4.0
• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion