Type Confusion in CedarJava via Reserved JSON Keys

Executive Summary

CVE-2026-55772 is a type confusion vulnerability in CedarJava, which is an open-source Java implementation of the Cedar policy language used for fine-grained authorization decisions.

The vulnerability occurs due to improper input handling across the Java-Rust Foreign Function Interface (FFI) boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves special single-key objects (__entity and __extn) for entity references and extension values.

When serializing a CedarMap, there is no validation to prevent these reserved keys from being used. If an integrating service constructs a CedarMap from caller-supplied data (such as request headers, user-defined metadata, or resource tags), an attacker who controls those keys could manipulate the system into interpreting a record as an entity reference.

For this vulnerability to be exploited, two conditions must be met: the integrating service must build a CedarMap from user-controlled keys, and a policy must reference that value in a when/unless clause.

This issue has been fixed in CedarJava versions 2.3.6, 3.4.1, and 4.9.0.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your system is using an affected version of CedarJava (prior to 2.3.6, 3.4.1, or 4.9.0) and if untrusted input is being used to construct CedarMap objects with user-controlled keys.

• Identify the CedarJava version in use. If it is below 2.3.6, 3.4.1, or 4.9.0, the system is vulnerable.
• Review application code or configurations where CedarMap objects are constructed. Look for instances where caller-supplied data (e.g., request headers, metadata, or resource tags) is used as keys without validation.
• Check for the presence of reserved keys (__entity or __extn) in user-controlled input. This can be done by logging or inspecting the JSON payloads sent to the Rust cedar-policy evaluator.
• If schema-based validation is not enabled, verify whether policies reference CedarMap values in when/unless clauses, as this is a prerequisite for exploitation.

There are no direct network-based detection commands for this vulnerability, as it is a logic flaw in the application layer. Manual code review or static analysis tools are recommended to identify the issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have significant impacts on systems using affected versions of CedarJava for authorization decisions.

• An attacker could exploit this vulnerability to bypass authorization checks, potentially gaining unauthorized access to sensitive resources or performing actions they should not be allowed to perform.
• The CVSS score of 8.8 indicates a high severity, meaning the vulnerability could lead to impacts on confidentiality, integrity, and availability of the affected system.
• If an attacker controls the keys used to build a CedarMap, they could manipulate the authorization logic, leading to privilege escalation or unauthorized data access.

The exact impact depends on how CedarJava is integrated into your system and what policies are enforced, but it could allow attackers to circumvent security controls.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with several common standards and regulations, depending on the context in which CedarJava is used.

• GDPR: If the vulnerability leads to unauthorized access to personal data, it could result in a data breach, violating GDPR requirements for data protection and potentially leading to significant fines.
• HIPAA: For systems handling protected health information (PHI), unauthorized access due to this vulnerability could violate HIPAA's security and privacy rules, leading to non-compliance and potential penalties.
• Other standards like PCI DSS (for payment systems) or SOC 2 (for service organizations) could also be impacted if the vulnerability allows unauthorized access to sensitive data or systems.

Compliance violations may occur if the vulnerability is exploited, resulting in unauthorized data access, data leaks, or failure to meet regulatory requirements for access control and data protection.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade CedarJava to a patched version (2.3.6, 3.4.1, or 4.9.0 and above) immediately. This is the most effective mitigation.
• If upgrading is not immediately possible, enable schema-based request validation to ensure that CedarMap keys do not contain reserved values (__entity or __extn).
• Sanitize or validate all user-controlled input used as keys in CedarMap objects. Ensure that reserved keys are blocked or stripped before processing.
• Review and restrict policies that reference CedarMap values in when/unless clauses, especially if those values are derived from untrusted sources.
• Monitor authorization requests for suspicious activity, such as attempts to inject reserved keys into CedarMap objects.

Useful 0 Not Useful 0