CVE-2026-54516: Jackson Databind Auth Bypass Vulnerability

CVE-2026-54516 Overview

CVE-2026-54516 is a deserialization flaw in jackson-databind, the general-purpose data-binding and tree-model component of the Jackson Data Processor for Java. The vulnerability affects versions 2.21.0 through 2.21.3 and 3.1.0 through 3.1.3. The flaw resides in POJOPropertiesCollector._renameProperties(), which permits a property annotated with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. An attacker who submits the renamed JSON key writes directly to the private backing field, bypassing the @JsonIgnore annotation on the setter. The issue maps to [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes].

Critical Impact
Remote attackers can modify object fields that developers explicitly marked as non-deserializable, leading to integrity violations in applications relying on @JsonIgnore as a security boundary.

Affected Products

FasterXML jackson-databind 2.21.0 through 2.21.3
FasterXML jackson-databind 3.1.0 through 3.1.3
Java applications consuming untrusted JSON via jackson-databind with MapperFeature.INFER_PROPERTY_MUTATORS enabled (default)

Discovery Timeline

2026-06-23 - CVE-2026-54516 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54516

Vulnerability Analysis

The flaw lives in jackson-databind's property collection logic. When a Plain Old Java Object (POJO) declares a getter annotated with @JsonProperty("renamed") and a setter annotated with @JsonIgnore, POJOPropertiesCollector._renameProperties() renames the combined property instead of dropping it. The presence of @JsonIgnore on the setter is therefore not honored on the deserialization path.

With MapperFeature.INFER_PROPERTY_MUTATORS enabled by default, jackson-databind retains the private backing field as a writable mutator. During deserialization, BeanDeserializerFactory.addBeanProps() evaluates hasField(), finds it true, builds a FieldProperty, and marks the field writable. Attacker-supplied JSON containing the renamed key writes the private field directly through reflection.

Root Cause

The root cause is inconsistent annotation handling between the rename pass and the mutator-inference pass. @JsonIgnore on the setter is intended to block writes, but the renamer treats the property as live, and the mutator inference falls back to the private field. Developers using @JsonIgnore as a guard against client-controlled field assignment receive no protection.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker sends crafted JSON containing the renamed property name to any endpoint that deserializes input into a vulnerable POJO. The attacker overwrites the targeted field, breaking application-level invariants such as administrative flags, audit identifiers, or computed state.

text

// Patch reference from release-notes/VERSION-2.x
#5967: Renamed `@JsonIgnore`d setters can deserialize via private fields
 (fixed by Omkhar A)

2.21.3 (28-Apr-2026)

Source: FasterXML jackson-databind commit c3d56dd

text

// Patch reference from release-notes/VERSION (3.x)
#5967: Renamed `@JsonIgnore`d setters can deserialize via private fields
 (fixed by Omkhar A)

3.1.3 (01-May-2026)

Source: FasterXML jackson-databind commit e88cb17

Detection Methods for CVE-2026-54516

Indicators of Compromise

Inbound JSON payloads containing property keys that match @JsonProperty rename values on classes whose setters are annotated @JsonIgnore.
Unexpected mutations to private fields after deserialization, particularly fields backing security-sensitive state.
Application logs showing successful binding to properties intended to be ignored.

Detection Strategies

Inventory dependencies with Software Composition Analysis (SCA) tooling and flag jackson-databind versions 2.21.0 through 2.21.3 and 3.1.0 through 3.1.3.
Perform static analysis to identify classes combining @JsonProperty("...") on a getter with @JsonIgnore on the corresponding setter.
Add runtime assertions or unit tests that round-trip JSON through suspect DTOs and verify ignored fields remain unset.

Monitoring Recommendations

Capture HTTP request bodies for endpoints performing JSON binding and alert on keys matching known sensitive renamed properties.
Monitor build pipelines for transitive upgrades of jackson-databind that pin to vulnerable releases.
Forward application telemetry to a centralized analytics platform to correlate anomalous field writes with inbound traffic.

How to Mitigate CVE-2026-54516

Immediate Actions Required

Upgrade jackson-databind to 2.21.4 for the 2.x line or 3.1.4 for the 3.x line.
Audit DTOs and request models for the @JsonProperty getter plus @JsonIgnore setter pattern and refactor where possible.
Restrict deserialization to allow-listed types and avoid binding untrusted JSON directly into entities holding sensitive state.

Patch Information

The vulnerability is fixed in jackson-databind 2.21.4 and 3.1.4. See GitHub Security Advisory GHSA-9fxm-vc8v-hj55, Pull Request #5967, and Pull Request #5968 for the upstream fixes.

Workarounds

Disable MapperFeature.INFER_PROPERTY_MUTATORS on the ObjectMapper if the application can tolerate the behavioral change.
Remove the @JsonProperty rename from getters of fields whose setters are annotated @JsonIgnore, or mark the field itself @JsonIgnore to block reflective writes.
Introduce dedicated input DTOs that omit sensitive fields entirely, separating the read model from the write model.

bash

# Maven dependency override pinning to a patched release
mvn versions:use-dep-version \
  -Dincludes=com.fasterxml.jackson.core:jackson-databind \
  -DdepVersion=2.21.4 \
  -DforceVersion=true

# Gradle equivalent (build.gradle)
# implementation('com.fasterxml.jackson.core:jackson-databind') {
#     version { strictly '2.21.4' }
# }