CedarJava has a type confusion vulnerability

Summary

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (entity and extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.

Timeline

1. Jul 13, 2026, 6:44 PM UTCCVE published
2. Jul 21, 2026, 7:02 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Jul 21, 2026, 7:02 PM UTCRecord last updated

Affected versions

• cedar-policy cedar-java

  fixed in 2.3.6; From 3.1.2 · fixed in 3.4.1; From 4.0.0 · fixed in 4.9.0

• com.cedarpolicy:cedar-javaMaven

  fixed in 2.3.6

• com.cedarpolicy:cedar-javaMaven

  From 3.1.2 · fixed in 3.4.1

• com.cedarpolicy:cedar-javaMaven

  From 4.0.0 · fixed in 4.9.0

References 1