Cedar-policy vulnerabilities
We track 4 vulnerabilities in Cedar-policy products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 13, 2026.
Latest Cedar-policy vulnerabilities
- 8.8 High severity
authorization-for-expressjs: Interpretation Conflict
@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed.
- 8.8 High severity
cedar-java: Improper Control of Generation of Code
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injectio
- 8.8 High severity
cedar-java: Improper Control of Generation of Code
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 4.9.0, the EntityIdentifier.equals() has inverted null/self branches which could lead to incorrect equality compar
- 8.8 High severity
cedar-java: Access of Resource Using Incompatible Type
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Record-to-Entity type con