Vulnerability · Published Jul 13, 2026 · Assigned by GitHub_M
CVE-2026-55773CedarJava has a policy injection vulnerability
High 8.8
In plain English
A high-severity code injection in cedar-java from cedar-policy. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (" or \) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.cedarpolicy:cedar-java | 2.3.6 | GHSA-qmch-v2q9-wg4p |
| Maven | com.cedarpolicy:cedar-java | 3.4.1 | GHSA-qmch-v2q9-wg4p |
| Maven | com.cedarpolicy:cedar-java | 4.9.0 | GHSA-qmch-v2q9-wg4p |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| cedar-policy | cedar-java | < 2.3.6>= 3.1.2, < 3.4.1>= 4.0.0, < 4.9.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H