PT-2026-51602 · Unknown · Jackson-Databind

Omkhar · Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-54518

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.0.0 through 3.1.3

Description The UnwrappedPropertyHandler.processUnwrappedCreatorProperties() function replays buffered JSON into creator parameters without consulting prop.visibleInView(activeView). While the standard property-based creator path restricts creator properties based on the active view, this specific unwrapped-creator replay path bypasses that check. Consequently, a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped can be populated from untrusted JSON input even when a more restrictive view is active, potentially bypassing write-side authorization boundaries.

Recommendations Update to version 2.21.4 for the 2.21 line. Update to version 3.1.4 for the 3.x line.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-54518

GHSA-RCQC-6CW3-H962

Affected Products

Jackson-Databind

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-54518 · Security Note
• https://osv.dev/vulnerability/GHSA-rcqc-6cw3-h962 · Vendor Advisory
• https://github.com/FasterXML/jackson-databind/commit/721fa07ebbd4aab4a659a1a68940878315c3e341 · Note
• https://github.com/FasterXML/jackson-databind/pull/5973 · Note
• https://github.com/FasterXML/jackson-databind · Note
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962 · Note
• https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea · Note
• https://github.com/FasterXML/jackson-databind/pull/5971 · Note