{"id":"CVE-2026-55772","summary":"CedarJava has a type confusion vulnerability","details":"CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.","aliases":["GHSA-93g4-m6xv-cmvr"],"modified":"2026-07-23T08:25:16.662048Z","published":"2026-07-13T18:44:47.577Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-843"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55772.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55772.json"},{"type":"ADVISORY","url":"https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-93g4-m6xv-cmvr"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55772"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/cedar-policy/cedar-java","events":[{"introduced":"0"},{"fixed":"9aad59076b0d887cf100cb374a9526a069b69ae4"},{"fixed":"4aaefcec11560cdedd6e975773c14c1b799ae2d6"},{"fixed":"6dd91c6c273a9bd55d927280d71e13fec9ccaf33"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.3.6"},{"introduced":"3.1.2"},{"fixed":"3.4.1"},{"introduced":"4.0.0"},{"fixed":"4.9.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v4.2.2","v3.4.0","v3.3.0","v3.2.4","v3.2.0","v2.3.3"],"database_specific":{"vanir_signatures":[{"id":"CVE-2026-55772-08ba4545","signature_type":"Function","signature_version":"v1","source":"https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4","target":{"file":"CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java","function":"putAll"},"deprecated":false,"digest":{"function_hash":"327048920903005842958234820150902070415","length":61}},{"target":{"file":"CedarJava/src/main/java/com/cedarpolicy/value/PrimString.java"},"deprecated":false,"digest":{"line_hashes":["243667161905065760944844123520959975433","96168933787930321025870251253997749999","172125391400570524916881429052974539977"],"threshold":0.9},"id":"CVE-2026-55772-222c4622","signature_type":"Line","signature_version":"v1","source":"https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"},{"signature_version":"v1","source":"https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4","target":{"file":"CedarJava/src/main/java/com/cedarpolicy/value/PrimString.java","function":"toCedarExpr"},"deprecated":false,"digest":{"function_hash":"51859290183657171490516512443651307904","length":51},"id":"CVE-2026-55772-3001f6c1","signature_type":"Function"},{"target":{"file":"CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java","function":"toCedarExpr"},"deprecated":false,"digest":{"function_hash":"308642754128649439991931764923403552312","length":215},"id":"CVE-2026-55772-37187fe2","signature_type":"Function","signature_version":"v1","source":"https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"},{"target":{"file":"CedarJava/src/main/java/com/cedarpolicy/serializer/ValueCedarSerializer.java","function":"serialize"},"deprecated":false,"digest":{"function_hash":"62858109805503904017122267880979576511","length":1921},"id":"CVE-2026-55772-3c280c53","signature_type":"Function","signature_version":"v1","source":"https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"},{"target":{"file":"CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java","function":"CedarMap"},"deprecated":false,"digest":{"function_hash":"111011011842433270854423126650773139846","length":69},"id":"CVE-2026-55772-3f6c64bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"},{"target":{"file":"CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java"},"deprecated":false,"digest":{"line_hashes":["103030993888185932997632776400234697913","47183856613135364532003511227358693765","51922012883446185014035213860104335624","146040928124044907750508132186535787983","73066325357702450447291450827513783211","149440180663028187750496759602590139320","110219816685492252901834456230293323004","72058756116103568276665631242610517099","290923203825187035198851765622973356351","311083266000522211783495446593466340081","253131561201919543895071334718108588742","66161866562734769894876201094633531652","165743800591843351444347053096403648937","119294679416558209991008684726557419481","321821627279993721743655072298279630234","182030038468228517666878260860425169606","79006384390469138415336195000204729595","223756644134795793606264829266612106198"],"threshold":0.9},"id":"CVE-2026-55772-5872973b","signature_type":"Line","signature_version":"v1","source":"https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4"},{"digest":{"function_hash":"322249416741170729726922059779259964332","length":284},"id":"CVE-2026-55772-d73c48ce","signature_type":"Function","signature_version":"v1","source":"https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4","target":{"file":"CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java","function":"put"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["120293057369215088283564849508655532202","318857257331541576035179544772552424443","332046677919700560269517789097197033654","327671726817749460872449368278484687363"],"threshold":0.9},"id":"CVE-2026-55772-ff8d13c0","signature_type":"Line","signature_version":"v1","source":"https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4","target":{"file":"CedarJava/src/main/java/com/cedarpolicy/serializer/ValueCedarSerializer.java"}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55772.json","vanir_signatures_modified":"2026-07-23T08:25:16Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}