What is the CVSS score of CVE-2026-55771?

CVE-2026-55771 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of CedarJava are affected by CVE-2026-55771?

cedar-java versions before 4.9.0 contain a logic defect in entity identifier comparison that may cause incorrect authorization decisions if developers use this method in custom access control logic.. A patch is available.

How to fix or mitigate CVE-2026-55771?

Within 24 hours, audit your codebase for direct uses of EntityIdentifier.equals() in authorization or access control logic beyond Cedar's native decision engine. Within 7 days, prepare and test an upgrade to cedar-java 4.9.0 or later in a staging environment, validating that authorization policies remain effective. Complete production deployment of the patched cedar-java version across all systems within 30 days, prioritizing systems that handle sensitive access control decisions.

CedarJava CVE-2026-55771

EUVD-2026-43524 HIGH

Code Injection (CWE-94)

2026-07-13 GitHub_M

GHSA-4r9r-4425-74p7

RCE Java Code Injection Cedar Java

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.8 MEDIUM

Impact only manifests in non-default integrator code that uses equals() for trust decisions (AC:H); it yields incorrect comparisons affecting integrity with minor confidentiality, no availability or RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 28, 2026 - 16:02 EUVD

Analysis Generated

Jul 13, 2026 - 20:01 vuln.today

CVE Published

Jul 13, 2026 - 19:28 cve.org

HIGH 8.8

DescriptionCVE.org

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect equality comparisons. The EntityIdentifier.equals() method has inverted logic for null and self-reference checks, returning true for null comparisons and false for self-comparisons. This does not affect Cedar authorization decisions (computed in Rust from JSON), but could affect integrators who perform their own equality checks on entity identifiers. This issue has been fixed in version 4.9.0.

Articles & Coverage 1

News 3 New Java Vulnerabilities - 1 Critical, 2 High, 1 With POC Jul 14, 2026

AnalysisAI

Incorrect equality comparison in CedarJava (cedar-java) versions before 4.9.0 causes EntityIdentifier.equals() to return true when comparing against null and false when comparing an object to itself, due to inverted null/self-reference branches. Cedar's actual authorization decisions are unaffected because they are computed in Rust from JSON, but integrators who call equals() on entity identifiers in their own Java logic may make incorrect trust or access decisions. No public exploit identified at time of analysis; the issue is fixed in 4.9.0.

Technical ContextAI

CedarJava is the Java binding for Cedar, an open-source authorization policy language (developed by AWS/cedar-policy) used for fine-grained access control; the CPE cpe:2.3:a:cedar-policy:cedar-java:*:* confirms the affected component is the cedar-java library itself. The defect lives in the EntityIdentifier class's overridden equals(Object) method, where the standard Java contract (an object equals itself, and never equals null) is inverted - the null-check and self-reference branches are swapped, so o this returns false and o null returns true. Although the input labels this CWE-94 (Code Injection), that classification is inconsistent with the described behavior; the true root cause is an incorrect equality/comparison logic error (closer to CWE-697 'Incorrect Comparison' or CWE-595 'Comparison of Object References Instead of Object Contents'). Because Cedar's policy evaluation happens in a Rust engine consuming JSON, the flawed Java equals() only matters in code paths where a Java integrator directly compares EntityIdentifier objects.

RemediationAI

Upgrade cedar-java to version 4.9.0 or later, which corrects the inverted null/self branches in EntityIdentifier.equals() (Vendor-released patch: 4.9.0); this is the primary and definitive fix per GitHub Security Advisory GHSA-4r9r-4425-74p7 (https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-4r9r-4425-74p7). If an immediate upgrade is not possible, integrators should audit their code for any use of EntityIdentifier.equals() (including implicit uses in collections such as HashSet/HashMap keys, contains(), or list comparisons) and avoid relying on it for security-relevant comparisons - instead compare the underlying identifier string values directly, which sidesteps the inverted logic. The trade-off of that workaround is added application-side code and the need to ensure no third-party dependency internally calls the flawed equals(); it is a stopgap only, so schedule the 4.9.0 upgrade as the durable remediation.