CVE-2026-54518: jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind
Summary UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active.
Impact View-restricted unwrapped creator parameters can be set from untrusted input where @JsonView is used as a write-side authorization boundary.
Affected / Patched (verified via git tag --contains) - 2.21 line: >= 2.21.0, < 2.21.4 -> fixed in 2.21.4 (backport 721fa07, #5973) - 3.x line: >= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5971, d633bc0)
Severity / CWE Maintainer: minor. Reporter: HIGH. CWE-863 (Incorrect Authorization); related CWE-284.
Credits Omkhar Arasaratnam (@omkhar) - finder.
Other sources
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/tools.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 3.1.4 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.4 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.4 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 3.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54518?
CVE-2026-54518 has a medium severity rating of 6.5.
How do I fix CVE-2026-54518?
To fix CVE-2026-54518, update your jackson-databind library to the latest version where the vulnerability is patched.
What software is affected by CVE-2026-54518?
CVE-2026-54518 affects both maven/tools.jackson.core:jackson-databind and maven/com.fasterxml.jackson.core:jackson-databind.
What is the risk associated with CVE-2026-54518?
CVE-2026-54518 has a risk rating of 40, indicating potential exposure to threats due to its vulnerability.
What does CVE-2026-54518 exploit?
CVE-2026-54518 exploits a bypass in the @JsonView functionality for unwrapped creator parameters in jackson-databind.