Executive brief
Cedar-Java is a library used to manage fine-grained access control and authorization decisions in Java applications. A flaw in how the library compares identity information could lead to incorrect security decisions, potentially allowing unauthorized access or data exposure. While the core authorization engine is not directly affected, any custom security checks built by developers using this library may behave incorrectly.
Technical details
Cedar-Java contains multiple vulnerabilities including policy injection (CWE-94), type confusion (CWE-843), and incorrect equality comparison (CWE-697). Specifically, the EntityIdentifier.equals() method has inverted logic for null and self-reference checks, returning true for null comparisons and false for self-comparisons. While Cedar's core authorization decisions are computed in Rust and remain unaffected, Java integrators relying on this method for manual security-sensitive equality checks may experience logic bypasses. The vulnerability is reachable over the network if the application processes user-supplied entity identifiers. Patches are available in versions 2.3.6, 3.4.1, and 4.9.0.
Affected products
- cedar-policy cedar-java < 2.3.6, >= 3.1.2 < 3.4.1, >= 4.0.0 < 4.9.0
Timeline
- 2026-06-05: disclosed
- 2026-06-05: patched
- 2026-07-13: advisory: NVD publication
- 2026-07-28: advisory: GitHub Advisory Database publication