CLEANSTART-2026-NB17779: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...

Q: What must an attacker be able to do to exploit this issue?

The attacker needs to be able to supply a class-name type ID that Jackson databind processes. They can then place attacker-selected classes in generic arguments even when those classes do not match the declared type or would be rejected as direct type IDs.

Q: Is authentication or user interaction required?

No. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the potential impact?

The vulnerability is rated critical with a 9.8 severity score and has high impacts on confidentiality, integrity, and availability.

Q: How can I tell whether my deployment is affected?

Review whether the cleanstart/keycloak package processes attacker-controlled class-name type IDs through jackson-databind, particularly where generic type arguments can be supplied. The provided data does not identify affected versions or a fixed version.

Published Nov 5, 2026

Updated

Security vulnerability affects the keycloak package. jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs.

Affected Software

1 affected componentFixes available

cleanstart/keycloak<26.8.1-r1

26.8.1-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/keycloak to a version that resolves this vulnerability.
Fixed in 26.8.1-r1

Event History

Nov 5, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-110879

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker needs to be able to supply a class-name type ID that Jackson databind processes. They can then place attacker-selected classes in generic arguments even when those classes do not match the declared type or would be rejected as direct type IDs.

Is authentication or user interaction required?

No. The supplied vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the potential impact?

The vulnerability is rated critical with a 9.8 severity score and has high impacts on confidentiality, integrity, and availability.

How can I tell whether my deployment is affected?

Review whether the cleanstart/keycloak package processes attacker-controlled class-name type IDs through jackson-databind, particularly where generic type arguments can be supplied. The provided data does not identify affected versions or a fixed version.

CLEANSTART-2026-NB17779: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be ...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Is authentication or user interaction required?

What is the potential impact?

How can I tell whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Is authentication or user interaction required?

What is the potential impact?

How can I tell whether my deployment is affected?