CVE-2026-55772 cedar-policy CVE debrief

Who should care

Users of CedarJava versions prior to 2.3.6, 3.4.1, and 4.9.0 should be aware of this vulnerability and take steps to mitigate it. Affected operators, platforms, vulnerability-management teams, and security teams should review the vulnerability and implement necessary security measures.

Technical summary

CedarJava, an open-source Java implementation of the Cedar policy language, is vulnerable to a Record-to-Entity type confusion attack. In versions prior to 2.3.6, 3.4.1, and 4.9.0, improper input handling could allow an attacker to cause the Rust cedar-policy evaluator to interpret a record as an entity reference. This requires the integrating service to build a CedarMap where an actor controls the keys, and a policy must reference that value in a when/unless clause. The vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.

Defensive priority

High priority should be given to upgrading CedarJava to versions 2.3.6, 3.4.1, or 4.9.0, or later.

Recommended defensive actions

• Upgrade CedarJava to version 2.3.6, 3.4.1, or 4.9.0, or later.
• Review and validate user-supplied input to prevent unauthorized access.
• Implement additional security measures, such as input validation and sanitization.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail provide limited information about the vulnerability. Further investigation and testing are recommended to fully understand the impact of this vulnerability. Affected product deployments should be identified, and owners assigned for follow-up. The integrating service building CedarMap from caller-supplied key/value data should validate and sanitize user input to prevent unauthorized access. Additional security measures, such as input validation and sanitization, should be implemented.

Official resources