PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-55773 cedar-policy CVE debrief

CVE-2026-55773 is a high-severity vulnerability in CedarJava, an open-source Java implementation of the Cedar policy language. The vulnerability allows for cedar-expression injection via unescaped toCedarExpr(). This issue arises from the toCedarExpr() method on Cedar Value types not escaping special characters (such as quotes or backslashes) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.

Vendor
cedar-policy
Product
cedar-java
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-13
Original CVE updated
2026-07-13
Advisory published
2026-07-13
Advisory updated
2026-07-13

Who should care

Users of CedarJava versions prior to 2.3.6, 3.4.1, and 4.9.0 who use toCedarExpr() to build policy text at runtime from user-controlled input should apply the patches or mitigations. This includes developers and administrators responsible for systems utilizing CedarJava for fine-grained authorization decisions.

Technical summary

The toCedarExpr() method on Cedar Value types does not escape special characters (such as quotes or backslashes) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. This could lead to unauthorized access or modifications. The vulnerability is addressed in CedarJava versions 2.3.6, 3.4.1, and 4.9.0.

Defensive priority

High

Recommended defensive actions

  • Apply patches or mitigations
  • Review and update policy text
  • Monitor for suspicious activity
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE record was published on 2026-07-13T20:16:48.580Z and last modified on 2026-07-13T20:21:44.960Z. The source of this information is the CVE.org and NVD. The details provided are based on the available data at the time of publication. Further verification and review are recommended to ensure the accuracy and completeness of the information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-55773 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-55773

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-55773 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-55773

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.