6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54518

CVE-2026-54518: jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54518

CVE-2026-54518:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.fasterxml.jackson.core:jackson-databind	maven	>= 2.21.0, < 2.21.4	2.21.4
tools.jackson.core:jackson-databind	maven	>= 3.0.0, < 3.1.4	3.1.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the processUnwrappedCreatorProperties method within the UnwrappedPropertyHandler class across two different package paths for jackson-databind. This method is invoked during JSON deserialization when a class uses @JsonUnwrapped on a creator parameter (e.g., a constructor argument). The core of the issue is that the method iterates through creator properties and deserializes them from a buffered token stream without verifying if the property is actually visible in the active @JsonView. The @JsonView annotation is a mechanism to control which properties are serialized or deserialized for different contexts (e.g., 'public' vs. 'admin' views). By not checking the view, the deserializer would populate properties that should have been filtered out, leading to an incorrect authorization vulnerability. An attacker could exploit this by crafting a JSON payload that includes data for properties that are meant to be restricted, thereby bypassing the access control intended by the @JsonView annotation. The patches fix this by explicitly getting the active view from the DeserializationContext and checking prop.visibleInView(activeView) before proceeding with deserialization for each property.

Vulnerable functions

com.fasterxml.jackson.databind.deser.impl.UnwrappedPropertyHandler.processUnwrappedCreatorProperties

src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java

The function `processUnwrappedCreatorProperties` in `UnwrappedPropertyHandler` is responsible for deserializing unwrapped properties for object creation. The vulnerability exists because this function did not check if a property was visible in the currently active `JsonView`. This allowed an attacker to provide data for a property that should have been ignored based on the view, leading to an authorization bypass where sensitive properties could be set from untrusted data.

tools.jackson.databind.deser.impl.UnwrappedPropertyHandler.processUnwrappedCreatorProperties

src/main/java/tools/jackson/databind/deser/impl/UnwrappedPropertyHandler.java

This is the same vulnerability as in the `com.fasterxml.jackson` package, but in the newer `tools.jackson.databind` package for Jackson 3.x. The `processUnwrappedCreatorProperties` function fails to check for `@JsonView` visibility when processing unwrapped creator properties, allowing unauthorized setting of properties.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.