CVE-2026-55773

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-55773

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55773.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-55773

Aliases

GHSA-qmch-v2q9-wg4p

Published

2026-07-13T19:17:03Z

Modified

2026-08-12T16:41:22Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

CedarJava has a policy injection vulnerability

Details

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (" or ) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55773.json"
}

References

Affected packages

Git / github.com/cedar-policy/cedar-java

Affected ranges

Type

GIT

Repo

https://github.com/cedar-policy/cedar-java

Events

Introduced

Fixed

9aad59076b0d887cf100cb374a9526a069b69ae4

Fixed

4aaefcec11560cdedd6e975773c14c1b799ae2d6

Fixed

6dd91c6c273a9bd55d927280d71e13fec9ccaf33

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.6"
        },
        {
            "introduced": "3.1.2"
        },
        {
            "fixed": "3.4.1"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.9.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v2.*

v2.3.3

v3.*

v3.2.0

v3.2.4

v3.3.0

v3.4.0

v4.*

v4.2.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55773.json"

vanir_signatures

[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "327048920903005842958234820150902070415",
            "length": 61
        },
        "id": "CVE-2026-55773-08ba4545",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java",
            "function": "putAll"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "243667161905065760944844123520959975433",
                "96168933787930321025870251253997749999",
                "172125391400570524916881429052974539977"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55773-222c4622",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/PrimString.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "51859290183657171490516512443651307904",
            "length": 51
        },
        "id": "CVE-2026-55773-3001f6c1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/PrimString.java",
            "function": "toCedarExpr"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "308642754128649439991931764923403552312",
            "length": 215
        },
        "id": "CVE-2026-55773-37187fe2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java",
            "function": "toCedarExpr"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "62858109805503904017122267880979576511",
            "length": 1921
        },
        "id": "CVE-2026-55773-3c280c53",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/serializer/ValueCedarSerializer.java",
            "function": "serialize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "111011011842433270854423126650773139846",
            "length": 69
        },
        "id": "CVE-2026-55773-3f6c64bb",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java",
            "function": "CedarMap"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "103030993888185932997632776400234697913",
                "47183856613135364532003511227358693765",
                "51922012883446185014035213860104335624",
                "146040928124044907750508132186535787983",
                "73066325357702450447291450827513783211",
                "149440180663028187750496759602590139320",
                "110219816685492252901834456230293323004",
                "72058756116103568276665631242610517099",
                "290923203825187035198851765622973356351",
                "311083266000522211783495446593466340081",
                "253131561201919543895071334718108588742",
                "66161866562734769894876201094633531652",
                "165743800591843351444347053096403648937",
                "119294679416558209991008684726557419481",
                "321821627279993721743655072298279630234",
                "182030038468228517666878260860425169606",
                "79006384390469138415336195000204729595",
                "223756644134795793606264829266612106198"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55773-5872973b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "322249416741170729726922059779259964332",
            "length": 284
        },
        "id": "CVE-2026-55773-d73c48ce",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/value/CedarMap.java",
            "function": "put"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "120293057369215088283564849508655532202",
                "318857257331541576035179544772552424443",
                "332046677919700560269517789097197033654",
                "327671726817749460872449368278484687363"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-55773-ff8d13c0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/cedar-policy/cedar-java/commit/9aad59076b0d887cf100cb374a9526a069b69ae4",
        "target": {
            "file": "CedarJava/src/main/java/com/cedarpolicy/serializer/ValueCedarSerializer.java"
        }
    }
]

vanir_signatures_modified

"2026-08-12T16:41:22Z"