HomeCVE Intelligence › CVE-2026-55771
CVSS 8.8 HIGH Vulnerability

CVE-2026-55771: Cedar-Java has policy injection, type confusion, and incorrect equality comparison vulner…

Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, it could lead to incorrect equality comparisons. Impact E…

8.8CVSS Score
HIGHSeverity
NOCISA KEV
0.3%EPSS Score
VulnerabilityImpact Type

📋 Vulnerability Details

CVE IDCVE-2026-55771
Vendormaven
Affected Productcom.cedarpolicy:cedar-java
Vulnerability TypeVulnerability
CVSS Score8.8 (HIGH)
EPSS Score0.3% probability of exploitation in the next 30 days
Actively Exploited❌ No known exploitation
Patch StatusSee Vendor Advisory →
Reported ByCYBERDUDEBIVASH SENTINEL APEX Intelligence (via github_advisories)

🔬 Technical Analysis

#

Summary CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, it could lead to incorrect equality comparisons.

Impact EntityIdentifier.equals() has inverted null/self branches The EntityIdentifier.equals() method has inverted logic for null and self-reference checks, returning true for null comparisons and false for self-comparisons. This does not affect Cedar authorization decisions (computed in Rust from JSON), but could affect integrators who perform their own equality checks on entity identifiers.

Impacted versions: < 4.9

Patches

It has been addressed in CedarJava version 4.9 and above. We recommend upgrading to the latest version and ensuring any forked or deriva

📚 Advisory References

⚡ DETECTION RULES AVAILABLE

Get CVE-2026-55771 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries
🛡️ Get Detection Pack → 🔌 Access via API →

🔗 Related Intelligence