CVE-2026-55772

Name of the Vulnerable Software and Affected Versions CedarJava versions prior to 2.3.6 CedarJava versions prior to 3.4.1 CedarJava versions prior to 4.9

Description Improper input handling allows Record-to-Entity type confusion across the Java-Rust FFI (Foreign Function Interface) boundary. CedarJava transmits authorization requests to the Rust cedar-policy evaluator as JSON, using reserved single-key object shapes entity and extn for entity references and extension values. Because there is no validation during the serialization of a CedarMap, an actor who controls keys used to build a CedarMap (such as through request headers, user-defined metadata, or resource tags) can force the Rust evaluator to interpret a record as an entity reference. This occurs when an integrating service builds a CedarMap with actor-controlled keys and a policy references that value in a when/unless clause.

Recommendations Update to version 2.3.6. Update to version 3.4.1. Update to version 4.9. Validate that user-controlled data does not contain the reserved keys entity or extn before building CedarMap objects. Enable schema-based request validation to detect type mismatches.