CedarJava is an open‑source Java implementation of the Cedar policy language used for fine‑grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, improper input handling can allow Record‑to‑Entity type confusion across the Java‑Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar‑policy evaluator as JSON, and the protocol reserves magic single‑key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, no validation prevents these reserved keys from being used. If an integrating service builds a CedarMap from caller‑supplied key/value data—such as request headers, user‑defined metadata, or resource tags—an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. The issue requires that a policy reference the controlled value in a when/unless clause, allowing an attacker who controls the keys to trigger type confusion that can grant unauthorized access to protected resources. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.

The product affected is cedar‑policy’s CedarJava library. Versions before 2.3.6, 3.4.1, and 4.9.0 are vulnerable. Applications that integrate CedarJava and marshal caller‑supplied data such as HTTP headers, metadata, or resource tags into CedarMaps without validation are at risk. This vulnerability requires that a policy reference the controlled value in a when/unless clause, so any project using user‑generated keys in policy expressions is potentially impacted.

The CVSS score of 8.8 indicates a high severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Exploitability is clear for systems whose integration code constructs CedarMaps from external input. An attacker capable of controlling the input keys – for example, through HTTP request headers or other user‑controlled data – can trigger type confusion and obtain unauthorized privileges. Given the high impact, immediate remediation is advisable.