Vulnerability · Published Jun 23, 2026 · Assigned by GitHub_M

CVE-2026-54518jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind

Medium 6.5

In plain English

A medium-severity incorrect authorization in jackson-databind from FasterXML. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 70.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:13	jackson-databind	no fix listed	DEBIAN-CVE-2026-54518
Debian:14	jackson-databind	no fix listed	DEBIAN-CVE-2026-54518
Maven	com.fasterxml.jackson.core:jackson-databind	2.21.4	GHSA-rcqc-6cw3-h962
Maven	tools.jackson.core:jackson-databind	3.1.4	GHSA-rcqc-6cw3-h962
Ubuntu:22.04:LTS	jackson-databind	no fix listed	UBUNTU-CVE-2026-54518
Ubuntu:24.04:LTS	jackson-databind	no fix listed	UBUNTU-CVE-2026-54518
Ubuntu:25.10	jackson-databind	no fix listed	UBUNTU-CVE-2026-54518
Ubuntu:26.04:LTS	jackson-databind	no fix listed	UBUNTU-CVE-2026-54518
Ubuntu:26.10	jackson-databind	no fix listed	UBUNTU-CVE-2026-54518

Affected products (as reported)

Vendor	Product	Versions
FasterXML	jackson-databind	>= 2.21.0, < 2.21.4>= 3.0.0, < 3.1.4

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962 x_refsource_CONFIRM
https://github.com/FasterXML/jackson-databind/pull/5971 x_refsource_MISC
https://github.com/FasterXML/jackson-databind/pull/5973 x_refsource_MISC
https://github.com/FasterXML/jackson-databind/commit/721fa07ebbd4aab4a659a1a68940878315c3e341 x_refsource_MISC
https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea x_refsource_MISC