CLEANSTART-2026-DP01123: DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator
Published Oct 30, 2026
·Updated
Security vulnerability affects the sonarqube package. DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator.
Affected Software
1 affected componentFixes available
cleanstart/sonarqube<26.9.0.129388-r1
26.9.0.129388-r1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.9.0.129388-r1
Event History
Oct 30, 2026
Advisory Published
via OSV·12:35 AM
Data Sourced
via OSV·12:35 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploitation require authentication or user interaction?
No privileges or user interaction are required. The vulnerability is remotely reachable over the network, but exploitation has high attack complexity.
2
Are deployments without a custom polymorphic type validator within scope?
Yes. The listed validator is applied automatically when @JsonTypeInfo is used without an explicitly configured custom validator.