Threat Intelligence Database

CVE-2026-55773 is a high-severity code injection vulnerability in cedar-java, an open source Java implementation of the Cedar policy language. Versions prior to 2.3.6, 3.4.1, and 4.9.0 improperly handle special characters in the toCedarExpr() method, allowing injection of arbitrary Cedar expressions when user-controlled input is used to build policy text at runtime. This can lead to unauthorized policy modifications such as unconditional permits or disabled forbids. The vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.

CVE-2026-55771 is a high-severity vulnerability in cedar-java versions prior to 4.9.0. The EntityIdentifier.equals() method contains inverted logic for null and self-reference checks, causing incorrect equality comparisons. While this flaw does not impact Cedar authorization decisions computed in Rust, it may affect integrators relying on Java-side equality checks. The issue has been fixed in version 4.9.0.

CVE-2026-55772 is a high-severity vulnerability in cedar-java, an open source Java implementation of the Cedar policy language. It involves a type confusion issue across the Java-Rust FFI boundary where improper input handling allows an attacker controlling certain keys in a CedarMap to cause the Rust evaluator to misinterpret a record as an entity reference. This occurs because the JSON protocol reserves special keys (__entity and __extn) without validation preventing their misuse. The vulnerability affects cedar-java versions prior to 2.3.6, versions from 3.0.0 up to but not including 3.4.1, and versions from 4.0.0 up to but not including 4.9.0. The issue requires specific conditions involving the integrating service and policy references. Fixes are available in versions 2.3.6, 3.4.1, and 4.9.0.