CedarJava CVE-2026-55772
HIGH
GHSA-93g4-m6xv-cmvr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable via integrating service (AV:N); AC:H because exploitation requires a specific integration pattern (user-controlled map keys) and a policy referencing it; PR:L for authenticated submitter; no direct availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionGitHub Advisory
Summary
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow type confusion across the Java-Rust FFI boundary.
Impact
Record-to-Entity type confusion across the Java-Rust FFI boundary
CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference.
This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause.
Impacted versions:
< 4.9
Patches
Addressed in CedarJava version 2.3.6, 3.4.1, and 4.9 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
Enable schema-based request validation to catch type mismatches. Validate that user-controlled data does not contain reserved keys (__entity or __extn) before building CedarMap objects.
References
If you have any questions or comments about this advisory, we ask that you contact us directly via email to [cedar-policy-security@lists.cncf.io](mailto:cedar-policy-security@lists.cncf.io). Please do not create a public GitHub issue.
Articles & Coverage 1
AnalysisAI
Type confusion in CedarJava versions prior to 2.3.6, 3.4.1, and 4.9 allows authenticated remote attackers to manipulate authorization decisions by injecting reserved JSON keys (__entity or __extn) into CedarMap objects built from attacker-controlled input. When an integrating service constructs a CedarMap from caller-supplied data such as headers, metadata, or resource tags, the Rust cedar-policy evaluator can be tricked into interpreting a record as an entity reference, undermining fine-grained authorization. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific application pattern: the integrating service must construct a CedarMap whose KEYS are populated from attacker-controlled input (request headers, user-defined metadata, resource tags), AND a Cedar policy must reference the resulting map value inside a `when` or `unless` clause. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector (8.8) treats this as a network-accessible, low-complexity, low-privilege flaw with high CIA impact - but that scoring assumes the typical deployment in which CedarJava sits behind a service that exposes Cedar evaluation to remote callers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits an HTTP request to a service that uses CedarJava for authorization, setting a custom header or resource tag whose key is literally `__entity` and whose value is a JSON object identifying a privileged principal or resource. The service serializes that user-controlled key/value pair into a `CedarMap` and includes it in the authorization request; the Rust evaluator decodes the record as an entity reference, and a policy clause like `when { principal.tags.role == ... … |
| Remediation | Vendor-released patch: upgrade to CedarJava 2.3.6, 3.4.1, or 4.9.0 (or later) depending on which release line you run, per https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-93g4-m6xv-cmvr. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all services using CedarJava versions prior to 2.3.6, 3.4.1, or 4.9 and document whether they construct CedarMap objects from headers, metadata, or other untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.tran
Cedar policy injection in CedarJava (com.cedarpolicy:cedar-java) versions below 2.3.6, 3.4.1, and 4.9.0 allows attackers
Remote code execution in Spinnaker's Orca and Rosco services allows authenticated users to achieve arbitrary Java class
Denial of service in Steeltoe.Discovery.Eureka client (.NET) versions prior to 4.2.0 and 3.4.0 allows a remote Eureka re
Regular expression denial of service in HAPI FHIR's DSTU2 FHIRPathEngine allows unauthenticated remote attackers to exha
Share
External POC / Exploit Code
Leaving vuln.today