CVE-2026-55772 CedarJava has a type confusion vulnerability

What is CVE-2026-55772?

CVE-2026-55772 is a high-severity vulnerability in cedar-policy cedar-java, published on 13 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.

Weakness: CWE-843

Which versions are affected by CVE-2026-55772?

6 open source packages ship an affected version, including com.cedarpolicy:cedar-java.

How do I fix CVE-2026-55772?

Upgrade com.cedarpolicy:cedar-java to a fixed version for your release line: 2.3.6, 3.4.1 or 4.9.0.

Is CVE-2026-55772 being exploited?

There is no known exploitation of CVE-2026-55772 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-93g4-m6xv-cmvr.