What is the CVSS score of CVE-2026-55773?

CVE-2026-55773 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of CedarJava are affected by CVE-2026-55773?

CedarJava authorization engine contains a high-severity policy injection vulnerability (CVE-2026-55773, CVSS 8.8) that allows attackers to bypass access controls by injecting expressions through…. A patch is available.

How to fix or mitigate CVE-2026-55773?

24 hours: Inventory systems using com.cedarpolicy:cedar-java versions below 2.3.6, 3.4.1, and 4.9.0. 7 days: Risk-assess which systems evaluate Cedar policies with untrusted input; audit recent policy changes and access logs for anomalies. 30 days: Monitor for vendor patches; implement compensating controls listed below.

CedarJava CVE-2026-55773

HIGH

Code Injection (CWE-94)

2026-06-19 https://github.com/cedar-policy/cedar-java

GHSA-qmch-v2q9-wg4p

RCE Java Code Injection

8.8

CVSS 3.1 · Vendor: https://github.com/cedar-policy/cedar-java

Severity by source

Vendor (https://github.com/cedar-policy/cedar-java) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Network reachable but exploitable only when integrator uses toCedarExpr() on user input (AC:H); requires app-level auth (PR:L); primary impact is authorization integrity, with limited confidentiality and no DoS.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/cedar-policy/cedar-java).

CVSS VectorVendor: https://github.com/cedar-policy/cedar-java

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 19, 2026 - 15:52 vuln.today

Analysis Generated

Jun 19, 2026 - 15:52 vuln.today

CVE Published

Jun 19, 2026 - 14:39 github-advisory

HIGH 8.8

DescriptionCVE.org

Summary

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow policy injection.

Impact

Cedar-expression injection via unescaped toCedarExpr()

The toCedarExpr() method on Cedar Value types does not escape special characters (" or \) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering.

This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input.

Impacted versions:

< 4.9

Patches

Addressed in CedarJava version 2.3.6, 3.4.1, and 4.9 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Validate and sanitize all user-supplied input before passing it to toCedarExpr(). Avoid building policy text at runtime from user-controlled values.

References

If you have any questions or comments about this advisory, we ask that you contact us directly via email to [cedar-policy-security@lists.cncf.io](mailto:cedar-policy-security@lists.cncf.io). Please do not create a public GitHub issue.

Articles & Coverage 1

News 3 New Java Vulnerabilities - 3 High Severity, No POC Available Jun 19, 2026

AnalysisAI

Cedar policy injection in CedarJava (com.cedarpolicy:cedar-java) versions below 2.3.6, 3.4.1, and 4.9.0 allows attackers to alter authorization outcomes by smuggling Cedar expressions through unescaped string values. The flaw is in toCedarExpr() on Cedar Value types, which fails to escape quote and backslash characters when serializing user-controlled values into policy text. No public exploit identified at time of analysis, but the integrity impact is severe because injected fragments like '|| true' can neutralize permit/forbid logic in fine-grained authorization decisions.

Technical ContextAI

CedarJava is the official Java binding for AWS/CNCF's Cedar policy language, used by applications to make fine-grained authorization decisions (permit/forbid clauses with when-conditions). The root cause is CWE-94 (Improper Control of Generation of Code, i.e., code injection): the toCedarExpr() helper that converts Cedar Value objects back into Cedar source code does not escape the string-delimiter (") or escape character (\), so a value containing those characters breaks out of its intended string literal and is reparsed as Cedar syntax. Affected Maven coordinates per the GHSA are com.cedarpolicy:cedar-java in the 2.x, 3.x (>= 3.1.2), and 4.x lines, all below the fixed releases 2.3.6, 3.4.1, and 4.9.0.

RemediationAI

Vendor-released patches are available: upgrade com.cedarpolicy:cedar-java to 2.3.6, 3.4.1, or 4.9.0 (or later) depending on the release line you track, per GHSA-qmch-v2q9-wg4p (https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p). If immediate upgrade is not possible, stop building policy text at runtime from user-controlled values and instead use parameterized Cedar entity/value APIs or pre-authored policies referenced by ID; where toCedarExpr() must be used on untrusted input, apply strict allowlist validation that rejects the quote (") and backslash (\) characters and any other Cedar metacharacters before passing values in, accepting the side effect that legitimate inputs containing those characters will be refused. Audit forked or vendored copies of cedar-java for the same toCedarExpr() code path and port the upstream fix.