CVE-2026-54515: jackson-databind Privilege Escalation

CVE-2026-54515 Overview

CVE-2026-54515 affects jackson-databind, the data-binding and tree-model component of the Jackson Data Processor for Java. Versions from 2.8.0 up to (but not including) 2.18.9, 2.21.5, and 3.1.4 contain a flaw in BeanDeserializerBase.createContextual(). When a property uses @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES), the deserializer rebuilds its BeanPropertyMap from the unfiltered this._beanProperties and overwrites the filtered map produced by _handleByNameInclusion(). Properties that were intended to be ignored through @JsonIgnoreProperties become writable again, undermining the declared exclusion policy [CWE-915].

Critical Impact
Properties an application declares as ignored can be deserialized from attacker-supplied JSON, leading to limited integrity impact on objects that mix @JsonIgnoreProperties with case-insensitive deserialization.

Affected Products

jackson-databind 2.8.0 through 2.18.8
jackson-databind 2.19.x through 2.21.4
jackson-databind 3.0.x through 3.1.3

Discovery Timeline

2026-06-23 - CVE-2026-54515 published to the National Vulnerability Database (NVD)
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54515

Vulnerability Analysis

The defect lives in BeanDeserializerBase.createContextual(), the routine Jackson invokes when contextualizing a deserializer for a specific property. The method first calls _handleByNameInclusion(), which honors per-property @JsonIgnoreProperties annotations and returns a contextual deserializer whose BeanPropertyMap has the ignored properties removed. So far the behavior matches developer expectations.

The second branch handles @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES). Instead of rebuilding from the filtered contextual._beanProperties, it rebuilds from this._beanProperties — the original, unfiltered map attached to the parent deserializer. The freshly built case-insensitive map then overwrites the filtered map. Every property that _handleByNameInclusion() had just removed is reinstated and accepts input again.

The issue is classified as Improperly Controlled Modification of Dynamically-Determined Object Attributes [CWE-915]. An attacker who can submit JSON to an endpoint that deserializes into a class combining both annotations can populate fields the application treated as read-only.

Root Cause

The rebuild logic references the wrong source map. this._beanProperties reflects the bean before per-property inclusion filtering, while contextual._beanProperties reflects the post-filter state. Using the former discards the result of _handleByNameInclusion() and reintroduces ignored properties.

Attack Vector

Exploitation requires an application to deserialize untrusted JSON into a target type where a property is excluded via @JsonIgnoreProperties and another property on the same bean uses @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES). The attacker submits a JSON payload that includes the supposedly ignored field. Jackson writes the value into the bean, allowing the attacker to override server-controlled state such as role flags, audit metadata, or internal identifiers.

text

// Patch note from release-notes/VERSION
#5962: Case-insensitive deserialization may use wrong `@JsonIgnoreProperties`
 (fixed by Omkhar A)

3.1.3 (01-May-2026)

Source: FasterXML/jackson-databind commit 0e1b0b2

Detection Methods for CVE-2026-54515

Indicators of Compromise

Inbound JSON payloads containing fields that the receiving bean declares in @JsonIgnoreProperties but that still appear in persisted state after deserialization.
Audit log entries showing modifications to bean properties that the application code never assigns explicitly.
Java applications shipping vulnerable jackson-databind JARs (2.8.0–2.18.8, 2.19.0–2.21.4, 3.0.0–3.1.3) on the classpath.

Detection Strategies

Run a Software Composition Analysis (SCA) scan against build manifests (pom.xml, build.gradle, gradle.lockfile) to enumerate jackson-databind versions in use.
Statically inspect domain models for classes that combine @JsonIgnoreProperties with @JsonFormat(with = ACCEPT_CASE_INSENSITIVE_PROPERTIES) on any property.
Add integration tests that submit JSON containing ignored field names and assert the resulting bean state remains unchanged.

Monitoring Recommendations

Forward application and Web Application Firewall (WAF) logs to a SIEM and alert on JSON request bodies referencing sensitive bean fields (for example, role, isAdmin, accountId).
Track dependency drift in CI/CD pipelines so newly introduced builds cannot regress to vulnerable jackson-databind versions.
Correlate API request payloads with object state changes to flag writes to properties marked as ignored.

How to Mitigate CVE-2026-54515

Immediate Actions Required

Upgrade jackson-databind to 2.18.9, 2.21.5, or 3.1.4 depending on the major version in use.
Inventory transitive dependencies that pull in jackson-databind and rebuild downstream artifacts after the upgrade.
Audit beans that mix @JsonIgnoreProperties with case-insensitive deserialization and verify their fields are not security-sensitive.

Patch Information

The fix corrects BeanDeserializerBase.createContextual() so the case-insensitive rebuild reads from the already filtered contextual._beanProperties map. The patched releases are jackson-databind2.18.9, 2.21.5, and 3.1.4. Patch details are available in the GitHub Security Advisory GHSA-5jmj-h7xm-6q6v and the corresponding upstream commit.

Workarounds

Remove ACCEPT_CASE_INSENSITIVE_PROPERTIES from @JsonFormat on affected beans until the upgrade lands.
Replace @JsonIgnoreProperties with a custom JsonDeserializer that explicitly rejects the ignored fields.
Enforce strict JSON schema validation at the API gateway to reject payloads containing fields outside the public contract.

bash

# Maven: pin the patched version
mvn versions:use-dep-version \
  -Dincludes=com.fasterxml.jackson.core:jackson-databind \
  -DdepVersion=2.21.5 \
  -DforceVersion=true

# Gradle: enforce the patched version across configurations
# build.gradle
# configurations.all {
#   resolutionStrategy.eachDependency { details ->
#     if (details.requested.group == 'com.fasterxml.jackson.core' &&
#         details.requested.name  == 'jackson-databind') {
#       details.useVersion '2.21.5'
#     }
#   }
# }