EntityIdentifier.equals() Null/Self Comparison Flaw in CedarJava

Executive Summary

CVE-2026-55771 is a vulnerability in CedarJava, an open-source Java implementation of the Cedar policy language used for fine-grained authorization decisions.

The issue lies in the `EntityIdentifier.equals()` method, where the logic for null and self-reference checks is inverted. This means the method incorrectly returns true when comparing an entity identifier to null and false when comparing an entity identifier to itself.

This flaw does not affect Cedar's core authorization decisions, which are computed in Rust from JSON. However, it could impact integrators who perform their own equality checks on entity identifiers in custom code.

The vulnerability affects versions of CedarJava prior to 4.9.0 and has been fixed in version 4.9.0.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking the version of the Cedar-Java library in use and inspecting code that may rely on the `EntityIdentifier.equals()` method for equality comparisons.

• Check the version of Cedar-Java in your project dependencies. If the version is prior to 4.9.0, the system is vulnerable.
• Review Java code for usage of `EntityIdentifier.equals()`. Look for custom equality checks involving `EntityIdentifier` objects, as these may produce incorrect results due to the inverted logic.
• For Maven projects, you can check the version in the `pom.xml` file under the `cedar-java` dependency. Example command to search for the dependency: `grep -A 5 'cedar-java' pom.xml`.
• For Gradle projects, check the `build.gradle` file for the `cedar-java` dependency. Example command: `grep -A 5 'cedar-java' build.gradle`.
• Static code analysis tools or IDE searches can be used to find instances of `EntityIdentifier.equals()` in your codebase.

Useful 0 Not Useful 0

Impact Analysis

If you are an integrator or developer using CedarJava and relying on the `EntityIdentifier.equals()` method for equality checks, this vulnerability could lead to incorrect behavior in your application.

• Security-sensitive comparisons may produce wrong results, potentially allowing unauthorized access or incorrect authorization decisions in custom logic.
• The vulnerability has a CVSS score of 8.8, indicating a high risk to confidentiality, integrity, and availability if exploited.

While Cedar's core authorization decisions (computed in Rust) are unaffected, any custom code that depends on proper equality checks could be compromised.

Useful 0 Not Useful 0

Compliance Impact

The impact on compliance with standards like GDPR or HIPAA depends on how CedarJava is used in your environment.

• If your application relies on `EntityIdentifier.equals()` for access control or data protection decisions, incorrect equality comparisons could lead to unauthorized data exposure or modification, potentially violating GDPR's data protection requirements or HIPAA's privacy and security rules.
• Since the vulnerability affects integrity and confidentiality, it could result in non-compliance if exploited, as these regulations mandate strict controls over access to sensitive data.

However, the core Cedar authorization system (computed in Rust) is unaffected, so compliance risks are limited to custom implementations that use the flawed method.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these steps:

• Upgrade the Cedar-Java library to version 4.9.0 or later, as the issue has been fixed in this version.
• If upgrading is not immediately possible, avoid using `EntityIdentifier.equals()` for security-sensitive comparisons. Replace it with custom equality logic that does not rely on the flawed method.
• Review and test any code that depends on `EntityIdentifier.equals()` to ensure it behaves as expected after the upgrade or workaround is applied.
• Monitor the official Cedar-Java advisory for any additional guidance or patches: https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-4r9r-4425-74p7.

Useful 0 Not Useful 0