Vulnerability-Lookup

GHSA-QMCH-V2Q9-WG4P

Vulnerability from github – Published: 2026-06-19 14:39 – Updated: 2026-06-19 14:39

Summary

CedarJava has policy injection vulnerability

Details

Summary

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow policy injection.

Impact

Cedar-expression injection via unescaped toCedarExpr()

The toCedarExpr() method on Cedar Value types does not escape special characters (" or \) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering.

This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input.

Impacted versions:

< 4.9

Patches

Addressed in CedarJava version 2.3.6, 3.4.1, and 4.9 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds

Validate and sanitize all user-supplied input before passing it to toCedarExpr(). Avoid building policy text at runtime from user-controlled values.

References

If you have any questions or comments about this advisory, we ask that you contact us directly via email to cedar-policy-security@lists.cncf.io. Please do not create a public GitHub issue.

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.cedarpolicy:cedar-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.cedarpolicy:cedar-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.2"
            },
            {
              "fixed": "3.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.cedarpolicy:cedar-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55773"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T14:39:25Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nCedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, improper input handling could allow policy injection.\n\n### Impact\n\n**Cedar-expression injection via unescaped `toCedarExpr()`**\n\nThe `toCedarExpr()` method on Cedar Value types does not escape special characters (`\"` or `\\`) when converting values to Cedar source code. If an integrator uses `toCedarExpr()` to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting `|| true` into a `permit ... when { ... }` clause could make the permit unconditional, or injecting `\u0026\u0026 false` into a `forbid` clause could prevent the `forbid` from triggering.\n\nThis issue requires the integrator to use `toCedarExpr()` to build policy text at runtime from user-controlled input.\n\n### Impacted versions: \n\u003c 4.9\n\n### Patches\nAddressed in CedarJava version 2.3.6, 3.4.1, and 4.9 and above. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n### Workarounds\nValidate and sanitize all user-supplied input before passing it to `toCedarExpr()`. Avoid building policy text at runtime from user-controlled values.\n\n### References\nIf you have any questions or comments about this advisory, we ask that you contact us directly via email to [cedar-policy-security@lists.cncf.io](mailto:cedar-policy-security@lists.cncf.io). Please do not create a public GitHub issue.",
  "id": "GHSA-qmch-v2q9-wg4p",
  "modified": "2026-06-19T14:39:25Z",
  "published": "2026-06-19T14:39:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cedar-policy/cedar-java"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "CedarJava has policy injection vulnerability"
}

CVE-2026-55773 (GCVE-0-2026-55773)

Vulnerability from cvelistv5 – Published: 2026-07-13 19:17 – Updated: 2026-07-13 19:17

Title

CedarJava has a policy injection vulnerability

Summary

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (" or \) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/cedar-policy/cedar-java/securi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
cedar-policy	cedar-java	Affected: < 2.3.6 Affected: >= 3.1.2, < 3.4.1 Affected: >= 4.0.0, < 4.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "cedar-java",
          "vendor": "cedar-policy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.1.2, \u003c 3.4.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (\" or \\) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting \u0026\u0026 false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-13T19:17:03.552Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p"
        }
      ],
      "source": {
        "advisory": "GHSA-qmch-v2q9-wg4p",
        "discovery": "UNKNOWN"
      },
      "title": "CedarJava has a policy injection vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55773",
    "datePublished": "2026-07-13T19:17:03.552Z",
    "dateReserved": "2026-06-17T14:34:51.881Z",
    "dateUpdated": "2026-07-13T19:17:03.552Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-QMCH-V2Q9-WG4P

Summary

Impact

Impacted versions:

Patches

Workarounds

References

CVE-2026-55773 (GCVE-0-2026-55773)

Tags

Sightings

Nomenclature