CVE-2026-59889

Awaiting Analysis Awaiting Analysis - Queue

Improper Access Control in Jackson Databind

Publication date: 2026-07-14

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-16

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-59889

Affected Vendors & Products

Vendor	Product	Version / Range
jackson	jackson-databind	From 2.18.0 (inc) to 2.18.9 (exc)
jackson	jackson-databind	2.21.5
jackson	jackson-databind	2.22.1
jackson	jackson-databind	3.1.5
jackson	jackson-databind	3.2.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in jackson-databind allows an attacker to bypass security controls by exploiting a flaw in how JSON properties are processed. When a property is annotated with both @JsonView and @JsonUnwrapped, the system may incorrectly deserialize and set values even when those values should be restricted by the active security view.

Detection Guidance

This vulnerability affects jackson-databind versions between 2.18.0 and 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1. To detect it, check the installed version of jackson-databind using commands like 'mvn dependency:tree' for Maven or 'gradle dependencies' for Gradle. If the version falls within the affected range, the system is vulnerable.

Impact Analysis

An attacker could potentially write data to fields that should be restricted, leading to unauthorized modifications or exposure of sensitive information. This could result in data leaks, privilege escalation, or other security breaches depending on how the application uses the affected library.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements for data protection such as GDPR or HIPAA. Organizations using affected versions may fail audits or face regulatory penalties if exploited.

Mitigation Strategies

Update jackson-databind to a patched version (2.18.9, 2.21.5, 2.22.1, 3.1.5, or 3.2.1) to address the vulnerability. Review code using @JsonUnwrapped and @JsonView annotations for potential exposure.

Hi! I’m here to help you understand CVE-2026-59889. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70