CVE-2026-55772 is a type confusion vulnerability (CWE-843) in cedar-java where improper input validation allows an attacker controlling keys in a CedarMap to exploit reserved JSON keys (__entity and __extn) used for entity references and extension values. This leads to the Rust cedar-policy evaluator interpreting a record as an entity reference incorrectly. The vulnerability arises from the lack of validation during serialization of CedarMap objects sent as JSON across the Java-Rust FFI boundary. Exploitation requires the integrating service to build a CedarMap from attacker-controlled keys and a policy referencing those values in a when/unless clause. The vulnerability affects cedar-java versions <2.3.6, >=3.0.0 <3.4.1, and >=4.0.0 <4.9.0 and has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.

Successful exploitation can lead to unauthorized access or privilege escalation due to the Rust evaluator misinterpreting data types, resulting in potentially high confidentiality, integrity, and availability impacts as indicated by the CVSS score of 8.8 (high). The attacker must control keys in the CedarMap and have a policy referencing those keys, which may limit exploitability depending on the integrating service's design.

A fix is available in cedar-java versions 2.3.6, 3.4.1, and 4.9.0. Users should upgrade to one of these versions to remediate the vulnerability. No vendor advisory content contradicts this; therefore, upgrading to a fixed version is the recommended mitigation.