CVE-2026-54518: fasterxml jackson-databind Incorrect Authorization

CVSS: 6.5v3.1MediumAnalyzed

AliasesUBUNTU-CVE-2026-54518DEBIAN-CVE-2026-54518CGA-22cf-g67g-f82f+771 more

Published 23-06-2026Last modified 24-06-2026

Vulnerability summary

CVE-2026-54518 is a medium (CVSS 6.5) Incorrect Authorization vulnerability in fasterxml jackson-databind. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 27.6% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.35%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-QM4F-RFVV-GQXQ

Timeline

23-06-2026
PublishedVulnerability first disclosed.
24-06-2026
Last modifiedVulnerability information updated.

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters but never consults prop.visibleInView(activeView). The normal property-based creator path gates creator properties on the active view, but this unwrapped-creator replay path bypasses that check, so a constructor parameter annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from attacker JSON even when a more restrictive view is active. This vulnerability is fixed in 2.21.4 and 3.1.4.

CVSS metrics

7 scores · 7 sources · 1 version

v3.16.5

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

28%

Versus all other CVEs

30-day change

0.00 pp

From 0.35% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected systems

Chainguard200 products

airbyte-server< 2.0.0-r3
airbyte-server-fips< 2.0.0-r3
akhq< 0.28.0-r2 | < 0.28.0-r1
apache-activemq-5.19< 5.19.8-r1
apache-activemq-6.1< 6.1.8-r8

apache-activemq-6.2< 6.2.7-r1
apache-activemq-fips-5.19< 5.19.8-r0
apache-activemq-fips-6.1< 6.1.8-r11
apache-activemq-fips-6.2< 6.2.7-r1
apache-camel-karavan-devmode< 4.18.1-r6
apache-hop< 2.18.1-r2
apache-hop-fips< 2.18.1-r2
apache-nifiAll versions (No fix recorded)
apache-nifi-2.11All versions (No fix recorded) | < 2.11.0-r6
apache-nifi-2.12All versions (No fix recorded)
apache-tika-2.9< 2.9.4-r17
apache-tika-3.2< 3.2.3-r18 | < 3.2.3-r13
apache-tika-3.2-compat< 3.2.3-r18
apache-tika-3.3< 3.3.1-r5
apache-tika-fips-2.9< 2.9.4-r9
apache-tika-fips-3.2< 3.2.3-r9
apache-tika-fips-3.3< 3.3.1-r2
apache-tomee-microprofile< 10.1.5-r1
apache-tomee-plume< 10.1.5-r1
apache-tomee-plus< 10.1.5-r1
apicurio-registry< 3.3.0-r6
cassandra-4.0< 4.0.20-r1
cassandra-4.1< 4.1.11-r1
cassandra-fips-4.0< 4.0.20-r3
cassandra-fips-4.1< 4.1.11-r1
confluent-kafka< 8.4.0.253-r2
confluent-kafka-jre-bcfips< 8.4.0.253-r1
dependency-track< 4.14.2-r3
dependency-track-apiserverAll versions (No fix recorded)
dependency-track-apiserver-5< 5.0.2-r1
dependency-track-bundled< 4.14.2-r3
dependency-track-v4-migrator< 5.0.2-r1
druid< 37.0.0-r19 | < 37.0.0-r56
elasticsearch-9.4< 9.4.7-r2
elasticsearch-9.4-iamguarded< 9.4.5-r3
elasticsearch-9.4-iamguarded-fips< 9.4.7-r3
elasticsearch-9.5< 9.5.2-r6
elasticsearch-9.5-iamguarded< 9.5.2-r6
elasticsearch-9.5-iamguarded-fips< 9.5.2-r5
elasticsearch-fips-9.4< 9.4.7-r3
elasticsearch-fips-9.5< 9.5.2-r5
flyway< 12.9.0-r1
flyway-fips< 12.9.0-r1
geoserver-2.27< 2.27.5-r14
geoserver-2.27-community< 2.27.5-r14
geoserver-2.28< 2.28.4-r3
geoserver-2.28-community< 2.28.4-r3
geoserver-3.0< 3.0.0-r1
infinispan-16.0< 16.0.13-r2
infinispan-16.1< 16.1.4-r5
jenkins-2-openjdk-21< 2.572-r0
jenkins-2-openjdk-25< 2.572-r0
jenkins-2.541All versions (No fix recorded)
jenkins-2.541-openjdk-17All versions (No fix recorded)
jenkins-2.541-openjdk-21All versions (No fix recorded)
jenkins-2.541-openjdk-25All versions (No fix recorded)
jenkins-2.555< 2.555.3-r2
jenkins-2.555-openjdk-21< 2.555.3-r2
jenkins-2.555-openjdk-25< 2.555.3-r2
jenkins-2.568< 2.568.1-r2
jenkins-2.568-openjdk-21< 2.568.1-r2
jenkins-2.568-openjdk-25< 2.568.1-r2
jenkins-plugin-manager< 2.15.0-r4
kafbat-ui< 1.5.0-r3
kafbat-ui-fips< 1.5.0-r2
kafka_exporter-strimzi-compat< 1.2.0-r4 | < 1.2.0-r5
kafka-4.1< 4.1.2-r3
kafka-4.2< 4.2.1-r3
kafka-4.3-oci-compatAll versions (No fix recorded)
kafka-4.3-openjdk-17< 4.3.1-r1
kafka-4.3-openjdk-21< 4.3.1-r1
kafka-4.3-openjdk-25< 4.3.1-r1
kafka-fips-4.1< 4.1.2-r4
kafka-fips-4.2< 4.2.1-r3
kafka-fips-4.3< 4.3.1-r1
kafka-strimzi-compatAll versions (No fix recorded) | < 1.2.0-r5
keycloak-26.5< 26.5.7-r8
keycloak-26.5-iamguarded-compat< 26.5.7-r8
keycloak-26.5-operator< 26.5.7-r8
keycloak-26.6< 26.6.4-r1
keycloak-26.6-iamguarded-compat< 26.6.4-r1
keycloak-26.6-operator< 26.6.4-r1
keycloak-config-cli< 6.5.1-r5
keycloak-config-cli-iamguarded-compat< 6.5.1-r5
keycloak-fips-26.5< 26.5.7-r14
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r14
keycloak-fips-26.5-operator< 26.5.7-r14
keycloak-fips-26.6< 26.6.4-r1
keycloak-fips-26.6-iamguarded-fips< 26.6.4-r1
keycloak-fips-26.6-operator< 26.6.4-r1
logstash-8.19< 8.19.17-r1
logstash-8.19-iamguarded-compat< 8.19.17-r1
logstash-8.19-with-output-opensearch< 8.19.17-r1
logstash-9.2All versions (No fix recorded)
logstash-9.2-iamguarded-compatAll versions (No fix recorded)
logstash-9.2-with-output-opensearchAll versions (No fix recorded)
logstash-9.3< 9.3.7-r0 | < 9.3.8-r0 | All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded) | < 9.3.8-r0 | < 9.3.7-r0
logstash-9.4< 9.4.2-r7
logstash-9.4-iamguarded-compat< 9.4.2-r7
logstash-fips-9.4< 9.4.2-r6
logstash-fips-9.4-iamguarded-compat< 9.4.2-r6
management-api-for-apache-cassandra-4.0< 0.1.122-r1
management-api-for-apache-cassandra-4.1< 0.1.122-r1
management-api-for-apache-cassandra-5.0< 0.1.122-r1
nacos< 3.2.2-r3
nacos-docker< 3.2.2-r1
neo4j-2026.02< 2026.02.3-r6
neo4j-2026.03< 2026.03.1-r6
neo4j-2026.04< 2026.04.0-r5
neo4j-2026.05< 2026.05.0-r4
neo4j-5.26< 5.26.27-r3
nextflow< 26.04.4-r1
nuxeo-2023< 2023.40-r8
opensearch-3< 3.7.0-r2
opensearch-3-alerting< 3.7.0-r2
opensearch-3-anomaly-detection< 3.7.0-r2
opensearch-3-crypto-kms< 3.7.0-r2
opensearch-3-discovery-ec2< 3.7.0-r2 | < 3.8.0-r3
opensearch-3-iamguarded-compatAll versions (No fix recorded)
opensearch-3-ml-commons< 3.7.0-r2
opensearch-3-neural-search< 3.7.0-r2 | All versions (No fix recorded) | < 3.8.0-r3
opensearch-3-notifications< 3.7.0-r2
opensearch-3-observability< 3.7.0-r2
opensearch-3-performance-analyzer< 3.7.0-r2
opensearch-3-reporting< 3.7.0-r2
opensearch-3-repository-azure< 3.7.0-r2
opensearch-3-repository-s3< 3.7.0-r2
opensearch-3-security< 3.7.0-r13 | < 3.7.0-r2
opensearch-3-sql< 3.7.0-r2
opensearch-fips-3< 3.7.0-r2
opensearch-fips-3-alerting< 3.7.0-r2
opensearch-fips-3-anomaly-detection< 3.7.0-r2
opensearch-fips-3-crypto-kms< 3.7.0-r2
opensearch-fips-3-discovery-ec2< 3.7.0-r2
opensearch-fips-3-ml-commons< 3.7.0-r2
opensearch-fips-3-neural-search< 3.7.0-r2
opensearch-fips-3-notifications< 3.7.0-r2
opensearch-fips-3-observability< 3.7.0-r2
opensearch-fips-3-performance-analyzer< 3.7.0-r2
opensearch-fips-3-reporting< 3.7.0-r2
opensearch-fips-3-repository-azure< 3.7.0-r2
opensearch-fips-3-repository-s3< 3.7.0-r2
opensearch-fips-3-security< 3.7.0-r12 | < 3.7.0-r2
opensearch-fips-3-sql< 3.7.0-r2
pinot< 1.5.1-r1
pinot-fips< 1.5.1-r1
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
reposilite< 3.5.28-r5
request-9047-keycloak-fips-26.4< 26.4.7-r19
request-9047-keycloak-fips-26.4-iamguarded-fips< 26.4.7-r19
request-9047-keycloak-fips-26.4-operator< 26.4.7-r19
request-9047-keycloak-fips-26.5< 26.5.7-r9
request-9047-keycloak-fips-26.5-iamguarded-fips< 26.5.7-r9
request-9047-keycloak-fips-26.5-operator< 26.5.7-r9
request-9047-keycloak-fips-26.6< 26.6.4-r1
request-9047-keycloak-fips-26.6-iamguarded-fips< 26.6.4-r1
request-9047-keycloak-fips-26.6-operator< 26.6.4-r1
ruby3.2-jrjackson< 0.5.2-r0
ruby3.3-jrjackson< 0.5.2-r0
ruby3.4-jrjackson< 0.5.2-r0
ruby4.0-jrjackson< 0.5.0-r1
scala-3.8< 3.8.4-r4
solr-10< 10.0.0-r6
solr-10-iamguarded-compat< 10.0.0-r6
sonarqube< 26.8.0.126808-r0
spark-4.0-scala-2.13< 4.0.4-r8
spark-4.1-scala-2.13< 4.1.2-r5 | < 4.1.3-r3
spark-4.2-scala-2.13< 4.2.0-r8
spark-fips-4.1-scala-2.13< 4.1.2-r11 | < 4.1.2-r4
spark-fips-4.2-scala-2.13< 4.2.0-r8
spark-kubernetes-operator< 0.9.0-r4
spdx-tools-java< 2.0.6-r5
strimzi-kafka-operatorAll versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-cluster-operator< 1.2.0-r4 | < 1.0.1-r2 | All versions (No fix recorded)
strimzi-kafka-operator-fips-cluster-operator< 1.0.1-r1
strimzi-kafka-operator-fips-kafka-agent< 1.0.1-r1
strimzi-kafka-operator-fips-kafka-init< 1.0.1-r1
strimzi-kafka-operator-fips-topic-operator< 1.0.1-r1
strimzi-kafka-operator-fips-tracing-agent< 1.0.1-r1
strimzi-kafka-operator-fips-user-operator< 1.0.1-r1
strimzi-kafka-operator-fips-v1-api-conversion< 1.0.1-r1
strimzi-kafka-operator-kafka-agent< 1.2.0-r5 | < 1.0.1-r2
strimzi-kafka-operator-kafka-base< 1.2.0-r5
strimzi-kafka-operator-kafka-initAll versions (No fix recorded) | < 1.0.1-r2 | < 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-topic-operator< 1.0.1-r2 | < 1.2.0-r5 | < 1.2.0-r4
strimzi-kafka-operator-tracing-agent< 1.0.1-r2 | < 1.2.0-r5
strimzi-kafka-operator-user-operator< 1.2.0-r5 | < 1.0.1-r2 | All versions (No fix recorded)
strimzi-kafka-operator-v1-api-conversion< 1.0.1-r2
thingsboard-tb-mqtt-transport< 4.3.1.2-r12
thingsboard-tb-node< 4.3.1.2-r12
trinoAll versions (No fix recorded) | < 482-r0 | < 483-r7