CVE-2026-59889: jackson-databind Privilege Escalation

CVE-2026-59889 Overview

CVE-2026-59889 is an authorization bypass vulnerability in jackson-databind, the general-purpose data-binding library for the Jackson Data Processor. The flaw affects versions from 2.18.0 through 2.18.8, 2.21.4, 2.22.0, 3.1.4, and 3.2.0. The UnwrappedPropertyHandler.processUnwrapped() method replays buffered JSON for a @JsonUnwrapped property without checking whether the target property is visible in the active @JsonView. Attackers with low-privilege access can populate fields that should be restricted to more privileged views, corrupting protected object state.

Critical Impact
A property annotated with both @JsonView and @JsonUnwrapped can be written from attacker-controlled JSON under a less-privileged active view, leading to integrity loss of protected data.

Affected Products

FasterXML jackson-databind 2.18.0 through 2.18.8
FasterXML jackson-databind 2.21.4, 2.22.0
FasterXML jackson-databind 3.1.4 and 3.2.0

Discovery Timeline

2026-07-14 - CVE-2026-59889 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-59889

Vulnerability Analysis

The vulnerability is an authorization flaw classified as [CWE-863] Incorrect Authorization. Jackson's @JsonView annotation restricts which properties are serialized or deserialized based on the active view class. When a property carries both @JsonView and @JsonUnwrapped, deserialization is deferred and replayed through UnwrappedPropertyHandler.processUnwrapped(). That replay path invokes prop.deserializeAndSet() without consulting prop.visibleInView(ctxt.getActiveView()). As a result, a caller operating under a less-privileged view can supply JSON that populates fields intended only for a privileged view. This breaks the view-based access control that applications frequently rely on to separate public, internal, and administrative data models.

Root Cause

The root cause is a missing view-visibility guard in the unwrapped-property replay loop inside src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java. Every other deserialization path filters properties against the active view, but the unwrapped handler iterates _properties and deserializes each one unconditionally. The fix retrieves ctxt.getActiveView() once and skips properties that fail visibleInView().

Attack Vector

Exploitation requires network-reachable access to an endpoint that deserializes JSON using jackson-databind with a @JsonView-scoped configuration. The attacker submits JSON containing keys that map to unwrapped properties gated by a more privileged view. The affected handler writes those values into the target bean despite the active view being less privileged. Impact is limited to integrity because the flaw enables writing but not reading of protected properties.

java

            Object bean, TokenBuffer buffered)
        throws IOException
    {
+        // [databind#6060]: honor active @JsonView -- skip Field/Setter properties not
+        // visible in the active view rather than populating them from buffered input.
+        final Class<?> activeView = ctxt.getActiveView();
        for (int i = 0, len = _properties.size(); i < len; ++i) {
            SettableBeanProperty prop = _properties.get(i);
+            if ((activeView != null) && !prop.visibleInView(activeView)) {
+                continue;
+            }
            JsonParser p = buffered.asParser(originalParser.streamReadConstraints());
            p.nextToken();
            prop.deserializeAndSet(p, ctxt, bean);

Source: FasterXML jackson-databind commit d627a8a

Detection Methods for CVE-2026-59889

Indicators of Compromise

Unexpected changes to bean properties that are guarded by privileged @JsonView classes but exposed through @JsonUnwrapped containers.
Application audit logs showing writes to restricted fields by users whose sessions run under a less-privileged view context.
HTTP request bodies containing JSON keys that match unwrapped properties reserved for administrative or internal views.

Detection Strategies

Inventory Java services using jackson-databind versions 2.18.0 through 2.18.8, 2.21.4, 2.22.0, 3.1.4, or 3.2.0 via software composition analysis.
Grep application code for classes that combine @JsonView and @JsonUnwrapped annotations on the same property, which are the only reachable sinks.
Instrument deserialization boundaries to log the active view and the set of properties written per request, then alert on view-property mismatches.

Monitoring Recommendations

Monitor dependency manifests (pom.xml, build.gradle) in CI/CD pipelines for vulnerable Jackson versions and fail builds until updated.
Track API endpoints that accept JSON payloads for anomalous field usage that correlates with elevated privileges.
Correlate deserialization events with downstream authorization decisions in your SIEM to catch privilege drift.

How to Mitigate CVE-2026-59889

Immediate Actions Required

Upgrade jackson-databind to 2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1, matching the fix branch for your current release train.
Audit all classes that use both @JsonView and @JsonUnwrapped on the same property and treat them as high-priority remediation targets.
Review recent access logs for endpoints that deserialize such objects to identify potential prior exploitation attempts.

Patch Information

The fix is committed in d627a8a86fcb062429282f79f3f256f181ed2c7b and shipped in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1. Details are published in the GitHub Security Advisory GHSA-5gvw-p9qm-jgwh and tracked in issue #6060 with the change delivered via pull request #6056.

Workarounds

Refactor affected models to avoid combining @JsonView with @JsonUnwrapped on the same property until the upgrade is deployed.
Enforce server-side authorization checks after deserialization so that view-based filtering is not the sole control on protected fields.
Apply input filtering at the API gateway to strip JSON keys that correspond to privileged unwrapped properties for low-privilege callers.

bash

# Maven dependency update example
mvn versions:use-dep-version -Dincludes=com.fasterxml.jackson.core:jackson-databind -DdepVersion=2.18.9 -DforceVersion=true

# Gradle verification
./gradlew dependencies --configuration runtimeClasspath | grep jackson-databind