CVE-2026-55773

Name of the Vulnerable Software and Affected Versions CedarJava versions prior to 2.3.6 CedarJava versions prior to 3.4.1 CedarJava versions prior to 4.9.0

Description Improper input handling in the toCedarExpr() method on Cedar Value types allows for Cedar-expression injection. The method fails to escape special characters such as double quotes (") or backslashes () when converting values to Cedar source code. If an integrator uses this method to build policy text at runtime using user-controlled values, an actor can inject arbitrary Cedar expressions. For instance, injecting || true into a permit ... when { ... } clause can make the permit unconditional, while injecting && false into a forbid clause can prevent it from triggering.

Recommendations Update CedarJava to version 2.3.6 or later. Update CedarJava to version 3.4.1 or later. Update CedarJava to version 4.9.0 or later. Validate and sanitize all user-supplied input before passing it to the toCedarExpr() method. Avoid building policy text at runtime from user-controlled values.