CLEANSTART-2026-EQ83185: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is rated as network-exploitable with low attack complexity. It requires no privileges and no user interaction.

Q: What is the potential impact of successful exploitation?

The severity is critical, with a CVSS score of 9.8. The supplied vector rates confidentiality, integrity, and availability impact as high.

Published Nov 14, 2026

Updated

Security vulnerability affects the elasticsearch package. jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs.

Affected Software

2 affected componentsFixes available

cleanstart/elasticsearch<9.2.8-r13

9.2.8-r13

cleanstart/elasticsearch<9.5.5-r5

9.5.5-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.2.8-r13
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r5

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-110879

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is rated as network-exploitable with low attack complexity. It requires no privileges and no user interaction.

What is the potential impact of successful exploitation?