Skip to main content
OneCon26: Gain the advantage in the AI era. Oct. 20–22 in Las Vegas.Register Now
Vulnerability Database/CVE-2026-86321

CVE-2026-86321: jackson-coreutils SSRF Vulnerability

CVE-2026-86321 is an SSRF vulnerability in jackson-coreutils 2.0 affecting the JsonLoader.fromURL function. Attackers can exploit inadequate URL validation to make unauthorized server-side requests. This article covers technical details, impact, and mitigation strategies.

Published:

CVE-2026-86321 Overview

CVE-2026-86321 is a Server-Side Request Forgery (SSRF) vulnerability in java-json-tools/jackson-coreutils version 2.0. The flaw resides in the JsonLoader.fromURL function within src/main/java/com/github/fge/jackson/JsonLoader.java, which performs URL validation before loading JSON content. Attackers can manipulate the URL input to coerce the server into issuing requests to unintended destinations. The issue is exploitable remotely without authentication or user interaction. A public exploit has been disclosed, and the upstream project had not responded to the initial issue report at the time of publication.

Critical Impact

Remote unauthenticated attackers can abuse JsonLoader.fromURL to force the application server to issue outbound HTTP(S) requests to internal or attacker-chosen endpoints, enabling internal reconnaissance and interaction with non-public services.

Affected Products

  • java-json-tools/jackson-coreutils version 2.0
  • Downstream Java applications embedding jackson-coreutils for JSON schema or JSON reference loading
  • Services exposing user-controlled input to JsonLoader.fromURL

Discovery Timeline

  • 2026-09-07 - CVE-2026-86321 published to the National Vulnerability Database
  • 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86321

Vulnerability Analysis

The vulnerability is classified as [CWE-918] Server-Side Request Forgery. The JsonLoader.fromURL method accepts a URL and fetches its contents to parse as JSON. The URL validation logic does not sufficiently restrict the destination of the outbound request. When an application forwards attacker-controlled input into this method, the server can be induced to contact arbitrary hosts, including private IP ranges, cloud metadata endpoints, and internal services not reachable from the internet.

Because jackson-coreutils is commonly used to resolve JSON references and load remote JSON schemas, the affected code path is often reachable from JSON schema validation flows. Any HTTP endpoint that accepts a schema URL, $ref, or arbitrary JSON document location represents a candidate attack surface.

Root Cause

The root cause is missing or insufficient allow-list validation on the URL scheme and host passed to JsonLoader.fromURL. The function does not filter out URLs pointing to loopback, link-local, or private address ranges, and does not enforce a scheme allow-list. Consequently, protocol handlers and internal endpoints available to the JVM process become reachable through the fetch operation.

Attack Vector

An unauthenticated remote attacker submits a crafted URL to any exposed application endpoint that ultimately calls JsonLoader.fromURL. The Java process resolves the hostname and issues an outbound request from the server's network position. Typical abuse cases include enumerating internal HTTP services, retrieving cloud instance metadata credentials, and pivoting to services that trust the server's IP. The vulnerability affects availability of the loading component but does not by itself yield confidentiality or integrity impact according to the assigned CVSS 4.0 vector.

A proof-of-concept and technical description are referenced in the upstream issue tracker. See GitHub Issue #64 and the VulDB entry for CVE-2026-86321 for further detail.

Detection Methods for CVE-2026-86321

Indicators of Compromise

  • Outbound HTTP requests originating from Java application servers directed at internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.0/8).
  • Requests from application hosts to cloud instance metadata endpoints such as 169.254.169.254.
  • Unexpected DNS lookups for internal hostnames from processes running jackson-coreutils.
  • Application logs showing JsonLoader.fromURL invocations with URLs supplied from untrusted input.

Detection Strategies

  • Perform a software composition analysis (SCA) scan of Java projects to identify use of com.github.fge:jackson-coreutils version 2.0.
  • Instrument application logging to record the URL argument passed into JsonLoader.fromURL and flag non-approved hosts.
  • Deploy network egress monitoring to alert on connections from application subnets to private ranges or metadata IPs.

Monitoring Recommendations

  • Forward application, DNS, and firewall telemetry to a centralized analytics platform and build correlation rules for SSRF patterns.
  • Baseline expected outbound destinations for each Java service and alert on deviations.
  • Enable audit logging on cloud metadata services (for example, IMDSv2 request logs) to detect unauthorized retrieval attempts.

How to Mitigate CVE-2026-86321

Immediate Actions Required

  • Inventory all applications and libraries that depend on java-json-tools/jackson-coreutils version 2.0.
  • Restrict or disable code paths that pass externally supplied URLs into JsonLoader.fromURL until a fix is deployed.
  • Enforce egress filtering from application servers to block traffic to internal ranges and cloud metadata endpoints.
  • Require Instance Metadata Service Version 2 (IMDSv2) with hop-limit 1 on AWS workloads to reduce SSRF exposure.

Patch Information

At the time of publication, the upstream java-json-tools/jackson-coreutils project had not published a fixed release. Monitor the jackson-coreutils GitHub repository and Issue #64 for a vendor response. Consider replacing the library with a maintained alternative if a patch is not forthcoming.

Workarounds

  • Wrap JsonLoader.fromURL calls in a validator that enforces an allow-list of permitted schemes (https) and hosts.
  • Reject URLs that resolve to loopback, link-local, private, multicast, or reserved IP ranges before fetching.
  • Route outbound schema fetches through an authenticated forward proxy that enforces destination policy.
  • Prefer JsonLoader.fromString or filesystem-based loading for trusted local schemas and disable remote fetching where possible.
bash
# Example egress restriction using iptables to block SSRF to metadata and private ranges
iptables -A OUTPUT -m owner --uid-owner java -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner java -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner java -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner java -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner java -d 127.0.0.0/8 -j REJECT

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne