CVE-2026-55772
CedarJava has a type confusion vulnerability
Description
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.
INFO
Published Date :
July 13, 2026, 7:17 p.m.
Last Modified :
Oct. 24, 2026, 10:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
Affected Products
The following products are affected by CVE-2026-55772
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update CedarJava to version 2.3.6 or later.
- Update CedarJava to version 3.4.1 or later.
- Update CedarJava to version 4.9.0 or later.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-55772.
| URL | Resource |
|---|---|
| https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-93g4-m6xv-cmvr |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-55772 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-55772
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-55772 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-55772 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: cedar-java de cedar-policy, Description: CedarJava es una implementación Java de código abierto del lenguaje de políticas Cedar, utilizada para decisiones de autorización de grano fino. En versiones anteriores a la 2.3.6, 3.4.1 y 4.9.0, bajo ciertas circunstancias, un manejo inadecuado de la entrada podría permitir una confusión de tipo de Registro a Entidad a través del límite FFI de Java-Rust. CedarJava envía solicitudes de autorización al evaluador de políticas Cedar de Rust como JSON. El protocolo JSON reserva formas de objeto mágicas de clave única (__entity y __extn) para referencias de entidad y valores de extensión. Al serializar un CedarMap, no hay validación que impida el uso de estas claves reservadas. Si un servicio integrador construye un CedarMap a partir de datos clave/valor proporcionados por el llamador (como encabezados de solicitud, metadatos definidos por el usuario o etiquetas de recursos), un actor que controle esas claves podría hacer que el evaluador de Rust interprete un registro como una referencia de entidad. Este problema requiere que el servicio integrador construya un CedarMap donde un actor controle las claves, y una política debe hacer referencia a ese valor en una cláusula when/unless. Esta vulnerabilidad ha sido corregida en las versiones 2.3.6, 3.4.1 y 4.9. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 21, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-55772', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-21T19:02:38.661180Z'} -
New CVE Received by [email protected]
Jul. 13, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'cedar-policy', 'product': 'cedar-java', 'versions': [{'status': 'affected', 'version': '< 2.3.6'}, {'status': 'affected', 'version': '>= 3.1.2, < 3.4.1'}, {'status': 'affected', 'version': '>= 4.0.0, < 4.9.0'}]}] Added Description CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-843 Added Reference https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-93g4-m6xv-cmvr