CVE-2026-55772 Details

A type confusion vulnerability has been identified in CedarJava, an open-source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. This vulnerability exists in versions prior to 2.3.6, 3.4.1, and 4.9.0. Under certain conditions, improper input handling can lead to Record-to-Entity type confusion across the Java-Rust Foreign Function Interface (FFI) boundary. CedarJava transmits authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol designates specific single-key object shapes (__entity and __extn) for entity references and extension values. When a CedarMap is serialized, there is no validation to prevent these reserved keys from being misused. If an integrating service creates a CedarMap from user-supplied key/value data, such as request headers or resource tags, an actor controlling those keys could manipulate the Rust evaluator into misinterpreting a record as an entity reference. This vulnerability requires the integrating service to construct a CedarMap with user-controlled keys, and for a policy to reference that value in a when/unless clause.

Users are advised to upgrade to CedarJava versions 2.3.6, 3.4.1, or 4.9 and above. It is also recommended to enable schema-based request validation to catch type mismatches and to ensure that user-controlled data does not include reserved keys (__entity or __extn) before creating CedarMap objects.