Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-06-23T20:48:52
jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-915
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass security controls by exploiting an issue in how properties are handled when both @JsonProperty (for renaming) and @JsonIgnore (for ignoring) annotations are used. By supplying a specially crafted JSON key, an attacker can directly write to a private data field, circumventing the intended security restrictions and potentially leading to unexpected data modification.
Moderate: This flaw in jackson-databind allows for property tampering and mass assignment in Red Hat products. When `MapperFeature.INFER_PROPERTY_MUTATORS` is enabled by default, an attacker can bypass `@JsonIgnore` annotations on setters by supplying a renamed JSON key, directly writing to private backing fields and circumventing intended security controls.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Cryostat 4
Fix deferred
jackson-databind
OpenShift Developer Tools and Services
Fix deferred
jenkins
OpenShift Developer Tools and Services
Fix deferred
jenkins-2-plugins
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel8
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-dispatcher-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-receiver-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
Red Hat AI Inference Server
Not affected
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Not affected
rhaii/vllm-gaudi-rhel9
Red Hat AMQ Broker 7
Fix deferred
jackson-databind
Red Hat AMQ Clients
Fix deferred
jackson-databind
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
python3.11-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3.12-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3x-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python-drools-jpy-jar
Red Hat build of Apache Camel 4 for Quarkus 3
Not affected
jackson-databind
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
jackson-databind
Red Hat build of Apache Camel - HawtIO 4
Fix deferred
jackson-databind
Red Hat build of Apicurio Registry 3
Fix deferred
jackson-databind
Red Hat build of Debezium 3
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9-operator
Red Hat Build of Keycloak
Fix deferred
rhbk-openshift-rhel9/rhbk-openshift-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk-rhel9-operator/rhbk-rhel9-operator
Red Hat build of Quarkus
Affected
jackson-databind
Red Hat Certificate System 10
Fix deferred
redhat-pki:10/redhat-pki
Red Hat Data Grid 8
Fix deferred
jackson-databind
Red Hat Enterprise Linux 10
Not affected
dogtag-pki
Red Hat Enterprise Linux 8
Not affected
pki-deps:10.6/jackson-databind
Red Hat Enterprise Linux 9
Not affected
jackson-databind
Red Hat Enterprise Linux AI (RHEL AI) 3
Not affected
rhelai3/bootc-gaudi-rhel9
Red Hat Fuse 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 8
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform Expansion Pack
Fix deferred
jackson-databind
Red Hat Lightspeed for Runtimes Operator
Fix deferred
rh-lightspeed-runtimes/runtimes-agent-init-rhel9
Red Hat Offline Knowledge Portal
Fix deferred
offline-knowledge-portal/rhokp-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-modelmesh-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-spark-operator-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-trustyai-service-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Not affected
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/multicluster-redirector-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/pluginregistry-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/server-rhel9
Red Hat Satellite 6
Fix deferred
candlepin
Red Hat Satellite 6
Fix deferred
openvox-server
Red Hat Satellite 6
Fix deferred
puppetserver
Red Hat Satellite 6
Fix deferred
satellite:el8/candlepin
Red Hat Satellite 6
Fix deferred
satellite:el8/puppetserver
Red Hat Single Sign-On 7
Fix deferred
jackson-databind
streams for Apache Kafka 2
Fix deferred
jackson-databind
streams for Apache Kafka 3
Fix deferred
jackson-databind
https://www.cve.org/CVERecord?id=CVE-2026-54516
https://nvd.nist.gov/vuln/detail/CVE-2026-54516
https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a
https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af
https://github.com/FasterXML/jackson-databind/pull/5967
https://github.com/FasterXML/jackson-databind/pull/5968
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55