CVE-2026-55772 is a type confusion vulnerability (CWE-843) in cedar-java that occurs due to improper input validation when serializing CedarMap objects across the Java-Rust FFI boundary. The JSON protocol used reserves certain single-key object shapes (__entity and __extn) for entity references and extension values, but cedar-java versions prior to 2.3.6, 3.4.1, and 4.9.0 do not prevent these reserved keys from being used in CedarMap keys. If an integrating service constructs a CedarMap from caller-controlled data containing these reserved keys, the Rust cedar-policy evaluator may interpret a record as an entity reference, potentially leading to unauthorized access or policy bypass. Exploitation requires that the integrating service uses attacker-controlled keys and that a policy references those values in when/unless clauses. The vulnerability is fixed in versions 2.3.6, 3.4.1, and 4.9.0.

Successful exploitation can lead to unauthorized access or manipulation of authorization decisions due to type confusion between records and entity references in the policy evaluation process. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H).

This vulnerability has been fixed in cedar-java versions 2.3.6, 3.4.1, and 4.9.0. Users should upgrade to one of these versions or later to remediate the issue. No official patch or temporary fix is indicated beyond upgrading. Until upgraded, integrating services should avoid building CedarMap objects from untrusted or actor-controlled key/value data containing reserved keys (__entity and __extn).