Executive brief
CedarJava is a software library used to make fine-grained security and authorization decisions within applications. A vulnerability exists where an attacker can provide specially crafted input—such as malicious request headers or metadata—to trick the system into misinterpreting data types. This could allow an attacker to bypass security policies, potentially leading to unauthorized access to sensitive data or administrative functions.
Technical details
A type confusion vulnerability (CWE-843) exists in CedarJava's serialization of CedarMap objects across the Java-Rust Foreign Function Interface (FFI) boundary. The JSON protocol used for communication reserves specific single-key object shapes (__entity and __extn) for entity references; however, CedarJava failed to validate that user-supplied keys did not use these reserved names. If an application builds a CedarMap using attacker-controlled keys (e.g., from HTTP headers or tags) and those values are evaluated in a policy's when/unless clause, the Rust evaluator can be tricked into treating a record as an entity reference. This can result in policy bypass or incorrect authorization decisions. The issue is fixed in versions 2.3.6, 3.4.1, and 4.9.0.
Affected products
- cedar-policy cedar-java < 2.3.6, >= 3.1.2 < 3.4.1, >= 4.0.0 < 4.9.0
Timeline
- 2026-06-18: advisory: GitHub advisory published by maintainers
- 2026-07-13: disclosed: CVE published to NVD
- 2026-07-13: patched: Fixes available in versions 2.3.6, 3.4.1, and 4.9.0