Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-06-23T21:02:07
jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-639
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.
A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass security view restrictions by sending specially crafted JSON (JavaScript Object Notation) data. The UnwrappedPropertyHandler component, which processes unwrapped properties, incorrectly populates constructor parameters that should be hidden by an active security view. This can lead to unauthorized information disclosure or data manipulation.
This Moderate vulnerability in jackson-databind allows a remote attacker to bypass security view restrictions. When processing unwrapped creator properties, the component fails to properly enforce @JsonView annotations, enabling sensitive constructor parameters to be populated from untrusted JSON data. This could lead to unauthorized information disclosure or data manipulation in applications utilizing specific jackson-databind configurations.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Cryostat 4
Fix deferred
jackson-databind
OpenShift Developer Tools and Services
Fix deferred
jenkins
OpenShift Developer Tools and Services
Fix deferred
jenkins-2-plugins
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel8
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-dispatcher-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-receiver-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-gaudi-rhel9
Red Hat AMQ Broker 7
Fix deferred
jackson-databind
Red Hat AMQ Clients
Fix deferred
jackson-databind
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
python3.11-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3.12-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3x-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python-drools-jpy-jar
Red Hat build of Apache Camel 4 for Quarkus 3
Not affected
jackson-databind
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
jackson-databind
Red Hat build of Apache Camel - HawtIO 4
Fix deferred
jackson-databind
Red Hat build of Apicurio Registry 3
Fix deferred
jackson-databind
Red Hat build of Debezium 3
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9-operator
Red Hat Build of Keycloak
Fix deferred
rhbk-openshift-rhel9/rhbk-openshift-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk-rhel9-operator/rhbk-rhel9-operator
Red Hat build of Quarkus
Affected
jackson-databind
Red Hat Certificate System 10
Fix deferred
redhat-pki:10/redhat-pki
Red Hat Data Grid 8
Fix deferred
jackson-databind
Red Hat Enterprise Linux 10
Not affected
dogtag-pki
Red Hat Enterprise Linux 8
Not affected
pki-deps:10.6/jackson-databind
Red Hat Enterprise Linux 9
Not affected
jackson-databind
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gaudi-rhel9
Red Hat Fuse 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 8
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform Expansion Pack
Fix deferred
jackson-databind
Red Hat Lightspeed for Runtimes Operator
Fix deferred
rh-lightspeed-runtimes/runtimes-agent-init-rhel9
Red Hat Offline Knowledge Portal
Fix deferred
offline-knowledge-portal/rhokp-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-modelmesh-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-spark-operator-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-trustyai-service-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/multicluster-redirector-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/pluginregistry-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/server-rhel9
Red Hat Satellite 6
Fix deferred
candlepin
Red Hat Satellite 6
Fix deferred
openvox-server
Red Hat Satellite 6
Fix deferred
puppetserver
Red Hat Satellite 6
Fix deferred
satellite:el8/candlepin
Red Hat Satellite 6
Fix deferred
satellite:el8/puppetserver
Red Hat Single Sign-On 7
Fix deferred
jackson-databind
streams for Apache Kafka 2
Fix deferred
jackson-databind
streams for Apache Kafka 3
Fix deferred
jackson-databind
https://www.cve.org/CVERecord?id=CVE-2026-54518
https://nvd.nist.gov/vuln/detail/CVE-2026-54518
https://github.com/FasterXML/jackson-databind/commit/721fa07ebbd4aab4a659a1a68940878315c3e341
https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea
https://github.com/FasterXML/jackson-databind/pull/5971
https://github.com/FasterXML/jackson-databind/pull/5973
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962