CVE-2026-54518: FasterXML jackson-databind authorization bypass in UnwrappedPropertyHandler

CVE-2026-54518 · Severity: medium · CVSS 6.5 · Published 2026-06-23

FasterXML jackson-databind is a widely used Java library for converting data between JSON and Java objects. A flaw in how the library handles specific data-mapping instructions allows attackers to bypass security restrictions intended to limit which data fields can be modified. This could allow an unauthorized user to update sensitive internal fields, potentially leading to unauthorized data modification or privilege escalation within applications using the library.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-54518 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54518 being exploited in the wild.
How severe is CVE-2026-54518?
Medium severity, with a CVSS score of 6.5, published 23 June 2026.
Which products and versions are affected?
com.fasterxml.jackson.core:jackson-databind (Maven) >= 2.21.0, < 2.21.4, ECOSYSTEM:introduced=2.21.0,fixed=2.21.4; tools.jackson.core:jackson-databind (Maven) >= 3.0.0, < 3.1.4, ECOSYSTEM:introduced=3.0.0,fixed=3.1.4.
Is there a fix for CVE-2026-54518?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.4 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54518 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54518?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.4 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.21.4 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.4 or later
    # set tools.jackson.core:jackson-databind to 3.1.4 in your pom.xml or build.gradle

Technical details

An authorization bypass vulnerability exists in jackson-databind's UnwrappedPropertyHandler.processUnwrappedCreatorProperties() method. When replaying buffered JSON into creator parameters, the library fails to consult the 'visibleInView' check for properties. Consequently, if a constructor parameter is annotated with both @JsonView and @JsonUnwrapped, an attacker can provide JSON input that populates these fields even when a more restrictive view is active. This allows for the modification of fields that were intended to be protected by the @JsonView write-side authorization boundary. The issue is fixed in versions 2.21.4 and 3.1.4.

Affected products

  • FasterXML jackson-databind >= 2.21.0, < 2.21.4
  • FasterXML jackson-databind >= 3.0.0, < 3.1.4

Identifiers

  • CVE-2026-54518
  • GHSA-rcqc-6cw3-h962

Timeline

  • 2026-05-07: patched: Fixes merged into 2.21 and 3.1 branches
  • 2026-06-16: advisory: GitHub Security Advisory published
  • 2026-06-23: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.