CVE-2026-55772

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55772", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T14:34:51.881Z", "datePublished": "2026-07-13T18:44:47.577Z", "dateUpdated": "2026-07-21T19:02:48.982Z"}, "containers": {"cna": {"title": "CedarJava has a type confusion vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-843", "lang": "en", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-93g4-m6xv-cmvr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-93g4-m6xv-cmvr"}], "affected": [{"vendor": "cedar-policy", "product": "cedar-java", "versions": [{"version": "< 2.3.6", "status": "affected"}, {"version": ">= 3.1.2, < 3.4.1", "status": "affected"}, {"version": ">= 4.0.0, < 4.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-13T18:44:47.577Z"}, "descriptions": [{"lang": "en", "value": "CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9."}], "source": {"advisory": "GHSA-93g4-m6xv-cmvr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-21T19:02:38.661180Z", "id": "CVE-2026-55772", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T19:02:48.982Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55772", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-21T19:02:38.661180Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-21T19:02:45.599Z"}}], "cna": {"title": "CedarJava has a type confusion vulnerability", "source": {"advisory": "GHSA-93g4-m6xv-cmvr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "cedar-policy", "product": "cedar-java", "versions": [{"status": "affected", "version": "< 2.3.6"}, {"status": "affected", "version": ">= 3.1.2, < 3.4.1"}, {"status": "affected", "version": ">= 4.0.0, < 4.9.0"}]}], "references": [{"url": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-93g4-m6xv-cmvr", "name": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-93g4-m6xv-cmvr", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-843", "description": "CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-13T18:44:47.577Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55772", "state": "PUBLISHED", "dateUpdated": "2026-07-21T19:02:48.982Z", "dateReserved": "2026-06-17T14:34:51.881Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-13T18:44:47.577Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cedar-java", "vendor": "cedar-policy", "versions": [{"status": "affected", "version": "< 2.3.6"}, {"status": "affected", "version": ">= 3.1.2, < 3.4.1"}, {"status": "affected", "version": ">= 4.0.0, < 4.9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This issue requires the integrating service to build a CedarMap where the an actor controls the keys, and a policy must reference that value in a when/unless clause. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9."}, {"lang": "es", "value": "CedarJava es una implementaci\u00f3n Java de c\u00f3digo abierto del lenguaje de pol\u00edticas Cedar, utilizada para decisiones de autorizaci\u00f3n de grano fino. En versiones anteriores a la 2.3.6, 3.4.1 y 4.9.0, bajo ciertas circunstancias, un manejo inadecuado de la entrada podr\u00eda permitir una confusi\u00f3n de tipo de Registro a Entidad a trav\u00e9s del l\u00edmite FFI de Java-Rust. CedarJava env\u00eda solicitudes de autorizaci\u00f3n al evaluador de pol\u00edticas Cedar de Rust como JSON. El protocolo JSON reserva formas de objeto m\u00e1gicas de clave \u00fanica (__entity y __extn) para referencias de entidad y valores de extensi\u00f3n. Al serializar un CedarMap, no hay validaci\u00f3n que impida el uso de estas claves reservadas. Si un servicio integrador construye un CedarMap a partir de datos clave/valor proporcionados por el llamador (como encabezados de solicitud, metadatos definidos por el usuario o etiquetas de recursos), un actor que controle esas claves podr\u00eda hacer que el evaluador de Rust interprete un registro como una referencia de entidad. Este problema requiere que el servicio integrador construya un CedarMap donde un actor controle las claves, y una pol\u00edtica debe hacer referencia a ese valor en una cl\u00e1usula when/unless. Esta vulnerabilidad ha sido corregida en las versiones 2.3.6, 3.4.1 y 4.9."}], "id": "CVE-2026-55772", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55772", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-21T19:02:38.661180Z", "version": "2.0.3"}}]}, "published": "2026-07-13T19:17:15.183", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-93g4-m6xv-cmvr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-843"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.1.2,3.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "cedar-java", "source": "cna", "vendor": "cedar-policy"}, "product": "cedar-java", "vendor": "cedar-policy"}], "created": "2026-07-14T13:15:10.624573+00:00", "updated": "2026-07-31T11:30:05.202611+00:00", "vendors": ["cedar-policy", "cedar-policy$PRODUCT$cedar-java"]}