CVE-2026-59889: FasterXML jackson-databind authorization bypass in @JsonUnwrapped properties

CVE-2026-59889 · Severity: medium · CVSS 6.5 · Published 2026-07-14

A vulnerability in the Jackson-databind library, a popular tool for processing JSON data in Java applications, allows attackers to bypass security restrictions during data entry. Developers often use 'Views' to restrict which pieces of data a user can modify; however, when certain data structures are 'unwrapped,' these restrictions are ignored. This could allow an unauthorized user to perform 'mass-assignment' attacks, such as elevating their own account privileges or modifying sensitive fields they should not have access to.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-59889 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59889 being exploited in the wild.
How severe is CVE-2026-59889?
Medium severity, with a CVSS score of 6.5, published 14 July 2026.
Which products and versions are affected?
FasterXML Jackson Databind >= 2.18.0, < 2.18.9; >= 2.21.0, < 2.21.5; >= 2.22.0, < 2.22.1; >= 3.0.0, < 3.1.5; >= 3.2.0, < 3.2.1, >= 2.18.0, <= 2.18.8; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.21.0,fixed=2.21.5; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.5.
Is there a fix for CVE-2026-59889?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.5 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59889 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-59889?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.5 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.21.5 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.5 or later
    # set tools.jackson.core:jackson-databind to 3.1.5 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Jackson-databind where UnwrappedPropertyHandler.processUnwrapped() fails to validate property visibility against the active view during deserialization. When a property is annotated with both @JsonView and @JsonUnwrapped, the library replays buffered JSON without checking the 'visibleInView' guard for the container property. This allows an attacker to provide JSON input for privileged fields that should be restricted by the active view. The issue affects both BeanDeserializer and BuilderBasedDeserializer. Patches are available in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Affected products

  • FasterXML jackson-databind >= 2.18.0, <= 2.18.8
  • FasterXML jackson-databind >= 2.21.0, < 2.21.5
  • FasterXML jackson-databind >= 2.22.0, < 2.22.1
  • tools.jackson.core:jackson-databind jackson-databind >= 3.0.0, <= 3.1.4
  • tools.jackson.core:jackson-databind jackson-databind >= 3.2.0, < 3.2.1

Identifiers

  • CVE-2026-59889
  • GHSA-5gvw-p9qm-jgwh

Timeline

  • 2026-07-10: patched: Fix published to FasterXML/jackson-databind
  • 2026-07-14: advisory: NVD publication date
  • 2026-07-21: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.