CVE-2026-55772: Cedar-Policy CedarJava type confusion in CedarMap serialization

CVE-2026-55772 · Severity: high · CVSS 8.8 · Published 2026-07-13

CedarJava is a software library used to make fine-grained security and authorization decisions within applications. A vulnerability exists where an attacker can provide specially crafted input—such as malicious request headers or metadata—to trick the system into misinterpreting data types. This could allow an attacker to bypass security policies, potentially leading to unauthorized access to sensitive data or administrative functions.

Technologies: Cedar Policy Cedar-Java, com.cedarpolicy:cedar-java (Maven). Vendors: Cedar Policy, Maven.

Quick answers

Is CVE-2026-55772 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55772 being exploited in the wild.
How severe is CVE-2026-55772?
High severity, with a CVSS score of 8.8, published 13 July 2026.
Which products and versions are affected?
Cedar Policy Cedar-Java < 2.3.6, >= 3.1.2 < 3.4.1, >= 4.0.0 < 4.9.0; com.cedarpolicy:cedar-java (Maven) ECOSYSTEM:introduced=0,fixed=2.3.6.
Is there a fix for CVE-2026-55772?
Yes. com.cedarpolicy:cedar-java (Maven): upgrade to 2.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55772 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-55772?
Check whether you run Cedar Policy Cedar-Java or com.cedarpolicy:cedar-java (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.cedarpolicy:cedar-java (Maven): upgrade to 2.3.6 or later
    # set com.cedarpolicy:cedar-java to 2.3.6 in your pom.xml or build.gradle

Technical details

A type confusion vulnerability (CWE-843) exists in CedarJava's serialization of CedarMap objects across the Java-Rust Foreign Function Interface (FFI) boundary. The JSON protocol used for communication reserves specific single-key object shapes (__entity and __extn) for entity references; however, CedarJava failed to validate that user-supplied keys did not use these reserved names. If an application builds a CedarMap using attacker-controlled keys (e.g., from HTTP headers or tags) and those values are evaluated in a policy's when/unless clause, the Rust evaluator can be tricked into treating a record as an entity reference. This can result in policy bypass or incorrect authorization decisions. The issue is fixed in versions 2.3.6, 3.4.1, and 4.9.0.

Affected products

  • cedar-policy cedar-java < 2.3.6, >= 3.1.2 < 3.4.1, >= 4.0.0 < 4.9.0

Identifiers

  • CVE-2026-55772
  • GHSA-93g4-m6xv-cmvr

Timeline

  • 2026-06-18: advisory: GitHub advisory published by maintainers
  • 2026-07-13: disclosed: CVE published to NVD
  • 2026-07-13: patched: Fixes available in versions 2.3.6, 3.4.1, and 4.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.