CVE-2026-59889 jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
Attackers can bypass @JsonView restrictions to modify data via @JsonUnwrapped properties during deserialization in jackson-databind.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59889?
CVE-2026-59889 is a medium-severity vulnerability in FasterXML jackson-databind, published on 14 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Weakness: CWE-863
Which versions are affected by CVE-2026-59889?
10 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | From 2.0.0-RC1 | 2.18.9 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.0.0-RC1 | 2.18.9 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.19.0 | 2.21.5 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.19.0 | 2.21.5 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.22.0 | 2.22.1 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.22.0 | 2.22.1 |
4 more packages
tools.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.5 |
tools.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.5 |
tools.jackson.core:jackson-databind Maven | From 3.2.0 | 3.2.1 |
tools.jackson.core:jackson-databind Maven | From 3.2.0 | 3.2.1 |
How do I fix CVE-2026-59889?
Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.18.9, 2.21.5 or 2.22.1.
Is CVE-2026-59889 being exploited?
There is no known exploitation of CVE-2026-59889 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-AC21815, CLEANSTART-2026-AD03048, CLEANSTART-2026-DR49804, CLEANSTART-2026-HK23784, CLEANSTART-2026-ND24866, CLEANSTART-2026-NN37649 and 88 more.