CVE-2026-54518: jackson-databind Auth Bypass Vulnerability

CVE-2026-54518 Overview

CVE-2026-54518 is an authorization bypass [CWE-863] in jackson-databind, the data-binding and tree-model component of the Jackson Data Processor for Java. The flaw exists in UnwrappedPropertyHandler.processUnwrappedCreatorProperties(), which replays buffered JSON into creator parameters without calling prop.visibleInView(activeView). As a result, a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker-supplied JSON even when a more restrictive view is active. The issue affects versions from 2.21.0 up to (but not including) 2.21.4, and 3.1.x before 3.1.4.

Critical Impact
Attackers can supply JSON that sets restricted constructor fields gated by @JsonView, undermining intended access controls during deserialization.

Affected Products

com.fasterxml.jackson.core:jackson-databind versions 2.21.0 through 2.21.3
com.fasterxml.jackson.core:jackson-databind versions 3.1.0 through 3.1.3
Java applications using @JsonUnwrapped on @JsonCreator parameters with @JsonView gating

Discovery Timeline

2026-06-23 - CVE-2026-54518 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54518

Vulnerability Analysis

Jackson's @JsonView mechanism lets applications expose or hide fields based on an active view, commonly used to separate administrative properties from end-user input. The standard property-based creator path consults prop.visibleInView(activeView) before binding incoming JSON to a creator parameter. The unwrapped-creator replay path in UnwrappedPropertyHandler.processUnwrappedCreatorProperties() omits that check entirely.

When a constructor parameter carries both @JsonView(AdminView.class) and @JsonUnwrapped, buffered JSON for that parameter is replayed and assigned regardless of the active view. An attacker submitting JSON under a public view context can therefore populate fields the application expected to be inaccessible, such as role flags, internal identifiers, or audit fields.

Root Cause

The root cause is a missing view-visibility check on the unwrapped-creator replay path. The fix adds the prop.visibleInView(activeView) gate so that unwrapped creator properties honor the active @JsonView, matching the behavior of the normal creator path.

Attack Vector

Exploitation requires the target application to deserialize attacker-controlled JSON into a class whose constructor declares a parameter annotated with both @JsonUnwrapped and @JsonView. The attacker submits JSON containing the restricted property names; because the replay path skips the view check, those values are bound during object construction even when a less-privileged view is active on the ObjectMapper.

text

// Patch excerpt: release-notes/VERSION-2.x
 (fixed by Omkhar A)
#5969: `@JsonView` by-passed for some "setterless" creator properties
 (fixed by Omkhar A)
+#5971: `@JsonView` by-passed for unwrapped creator parameters
+ (fixed by Omkhar A)

2.21.3 (28-Apr-2026)

Source: FasterXML/jackson-databind commit 721fa07

Detection Methods for CVE-2026-54518

Indicators of Compromise

Unexpected modification of fields gated by @JsonView on classes that combine @JsonCreator with @JsonUnwrapped parameters.
Audit log entries showing privileged attribute changes originating from request handlers that should only expose a public view.
Deserialization stack traces referencing UnwrappedPropertyHandler.processUnwrappedCreatorProperties during processing of untrusted JSON.

Detection Strategies

Perform a software composition analysis (SCA) scan of build artifacts and lockfiles for jackson-databind versions 2.21.0–2.21.3 or 3.1.0–3.1.3.
Statically scan source code for constructor parameters annotated with both @JsonUnwrapped and @JsonView to identify exposure points.
Add deserialization unit tests that submit JSON with restricted-view properties under a permissive view and assert those fields remain null or default.

Monitoring Recommendations

Monitor application logs for binding events on sensitive fields received from endpoints that set a non-admin @JsonView.
Alert on dependency drift that introduces vulnerable jackson-databind versions through transitive updates.
Track changes to DTOs and request models that newly combine @JsonUnwrapped with view-gated properties.

How to Mitigate CVE-2026-54518

Immediate Actions Required

Upgrade jackson-databind to 2.21.4 or 3.1.4, which add the missing view-visibility check on the unwrapped-creator replay path.
Inventory DTOs that combine @JsonUnwrapped and @JsonView on creator parameters and treat them as high priority for the upgrade.
Until patched, avoid combining @JsonUnwrapped with @JsonView-gated fields on @JsonCreator constructor parameters.

Patch Information

The fix is delivered in jackson-databind2.21.4 and 3.1.4. The patch adds the prop.visibleInView(activeView) gate to UnwrappedPropertyHandler.processUnwrappedCreatorProperties(). See the upstream advisory GHSA-rcqc-6cw3-h962 and pull requests #5971 and #5973.