CVE-2026-55772 Overview
CVE-2026-55772 is a type confusion vulnerability [CWE-843] in CedarJava, the Java implementation of the Cedar policy language used for fine-grained authorization decisions. The flaw affects versions prior to 2.3.6, 3.4.1, and 4.9.0. CedarJava serializes authorization requests as JSON before sending them across the Foreign Function Interface (FFI) to the Rust cedar-policy evaluator. The JSON protocol reserves single-key object shapes __entity and __extn as magic markers for entity references and extension values. CedarJava does not validate CedarMap keys against these reserved names, allowing attacker-controlled input to be reinterpreted by the Rust evaluator as an entity reference rather than a record.
Critical Impact
An authenticated attacker who controls keys in a CedarMap referenced by a policy when/unless clause can cause the Rust evaluator to confuse a record with an entity reference, subverting authorization decisions.
Affected Products
- CedarJava versions prior to 2.3.6
- CedarJava versions prior to 3.4.1
- CedarJava versions prior to 4.9.0
Discovery Timeline
- 2026-07-13 - CVE-2026-55772 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2026-55772
Vulnerability Analysis
CedarJava passes authorization requests to the Rust cedar-policy evaluator using a JSON wire protocol. That protocol assigns special meaning to objects containing a single key of __entity or __extn, treating them as entity references or extension values rather than plain records. When CedarJava serializes a CedarMap, it does not enforce that user-supplied keys avoid these reserved names.
An integrating service that constructs a CedarMap from external sources such as HTTP request headers, user-defined metadata, or resource tags can therefore emit JSON that the Rust side parses as an entity reference. If a policy evaluates that value in a when or unless clause, the evaluator performs entity operations on data the caller controls, breaking the authorization model.
Root Cause
The root cause is missing input validation at the serialization boundary between Java and Rust components. CedarJava trusts that CedarMap keys are ordinary record field names and does not reject or escape the reserved sentinel keys __entity and __extn that the Rust evaluator interprets as type discriminators.
Attack Vector
Exploitation requires two conditions in the integrating service. First, application code must build a CedarMap whose keys are influenced by an untrusted actor, such as request headers or resource tags. Second, a Cedar policy must reference that map value inside a when or unless clause so the crafted key reaches the evaluator. When both conditions hold, a network-adjacent authenticated actor can submit a request whose metadata key equals __entity, causing the evaluator to treat the associated value as an entity reference and produce an incorrect authorization decision.
The vulnerability is described in prose only; refer to the GitHub Security Advisory GHSA-93g4-m6xv-cmvr for further technical details.
Detection Methods for CVE-2026-55772
Indicators of Compromise
- Authorization request payloads containing JSON keys equal to __entity or __extn originating from untrusted input surfaces such as headers, tags, or user metadata.
- Unexpected Cedar authorization allow decisions correlated with requests carrying metadata keys prefixed by double underscores.
- Evaluator errors or entity-lookup exceptions triggered during policy evaluation of caller-supplied map values.
Detection Strategies
- Inspect application logs and API gateway telemetry for inbound fields whose names match the reserved Cedar keys __entity and __extn.
- Instrument the CedarJava integration layer to log the fully serialized JSON sent across the FFI boundary and flag records containing reserved keys.
- Review Cedar policies to identify when and unless clauses that dereference maps built from untrusted input, then monitor those code paths at runtime.
Monitoring Recommendations
- Alert on authorization decisions that deviate from historical baselines for the same principal, action, and resource combination.
- Track dependency inventories to ensure CedarJava artifacts are pinned to fixed versions across all services.
- Aggregate CedarJava evaluator warnings and type-mismatch errors into a central SIEM for cross-service correlation.
How to Mitigate CVE-2026-55772
Immediate Actions Required
- Upgrade CedarJava to version 2.3.6, 3.4.1, or 4.9.0 depending on the current major branch in use.
- Audit every code path that populates a CedarMap from external input and reject keys beginning with double underscores.
- Review Cedar policies for when and unless clauses that consume caller-controlled maps and constrain the accepted key set.
Patch Information
The maintainers fixed CVE-2026-55772 in CedarJava 2.3.6, 3.4.1, and 4.9.0. The patched releases validate CedarMap keys during serialization to prevent the reserved sentinel names from crossing the FFI boundary. Full details are available in the GitHub Security Advisory GHSA-93g4-m6xv-cmvr.
Workarounds
- Sanitize or reject any external key that matches __entity or __extn before inserting it into a CedarMap.
- Restrict policy authoring guidelines so that untrusted map values are not referenced inside when or unless clauses until services are patched.
- Apply an allow-list of expected metadata keys at the ingress layer to block reserved names from reaching authorization logic.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
