CVE-2026-54518: jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind
Summary UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active.
Impact View-restricted unwrapped creator parameters can be set from untrusted input where @JsonView is used as a write-side authorization boundary.
Affected / Patched (verified via git tag --contains) - 2.21 line: >= 2.21.0, < 2.21.4 -> fixed in 2.21.4 (backport 721fa07, #5973) - 3.x line: >= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5971, d633bc0)
Severity / CWE Maintainer: minor. Reporter: HIGH. CWE-863 (Incorrect Authorization); related CWE-284.
Credits Omkhar Arasaratnam (@omkhar) - finder.
Other sources
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.
— MITRE
The use of specific values for the region input field when calling AWS services can allow an actor with access to the environment in which the SDK is used to set the region input field to an invalid value.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/tools.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 3.1.4 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.4 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.4Patch 721fa07 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 3.1.4Patch d633bc0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54518?
CVE-2026-54518 has a medium severity rating of 6.5.
How do I fix CVE-2026-54518?
To fix CVE-2026-54518, update your jackson-databind library to the latest version where the vulnerability is patched.
What software is affected by CVE-2026-54518?
CVE-2026-54518 affects both maven/tools.jackson.core:jackson-databind and maven/com.fasterxml.jackson.core:jackson-databind.
What is the risk associated with CVE-2026-54518?
CVE-2026-54518 has a risk rating of 40, indicating potential exposure to threats due to its vulnerability.
What does CVE-2026-54518 exploit?
CVE-2026-54518 exploits a bypass in the @JsonView functionality for unwrapped creator parameters in jackson-databind.