CVE-2026-59889

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Trends

Current EPSS score: 0.35%• Percentile: 28%

Techniques & Countermeasures

• CWE-863•Incorrect Authorization

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

• chainguard•airbyte-server

  < 2.0.0-r8

• chainguard•airbyte-server-fips

  < 2.0.0-r10

• chainguard•akhq

  < 0.27.1-r14

• chainguard•apache-activemq-5.19

  < 5.19.9-r2

• chainguard•apache-activemq-6.1

  < 6.1.8-r10

• chainguard•apache-activemq-6.2

  < 6.2.7-r4

• chainguard•apache-activemq-fips-5.19

  < 5.19.9-r1

• chainguard•apache-activemq-fips-6.1

  all

• chainguard•apache-activemq-fips-6.2

  < 6.2.8-r3

• chainguard•apache-nifi

  < 2.10.0-r11 | all

• chainguard•apache-nifi-2.11

  all | < 2.11.0-r6

• chainguard•apache-nifi-2.12

  all

• chainguard•apache-nifi-registry

  < 2.10.0-r6

• chainguard•apache-nifi-registry-toolkit

  < 2.10.0-r6

• chainguard•apache-polaris

  < 1.7.0-r4 | all

• chainguard•apache-polaris-fips

  all | < 1.7.0-r3

• chainguard•apache-pulsar-4.1

  all

• chainguard•apache-pulsar-fips-4.1

  all

• chainguard•apache-tika-2.9

  < 2.9.4-r18

• chainguard•apache-tika-3.1

  < 3.1.0-r35

• chainguard•apache-tika-3.2

  < 3.2.3-r15 | < 3.2.3-r18

• chainguard•apache-tika-3.2-compat

  < 3.2.3-r18

• chainguard•apache-tika-fips-3.0

  < 3.0.0-r10

• chainguard•apache-tika-fips-3.3

  < 3.3.2-r1

• chainguard•apicurio-registry

  < 3.3.0-r11

• chainguard•apicurio-registry-fips

  < 3.3.0-r8

• chainguard•camunda-8.8

  < 8.8.31-r3

• chainguard•camunda-zeebe-8.6

  all

• chainguard•camunda-zeebe-8.7

  < 8.7.35-r2

• chainguard•camunda-zeebe-8.8

  < 8.8.32-r0

• chainguard•cassandra-4.0

  < 4.0.20-r3

• chainguard•cassandra-4.1

  < 4.1.11-r3

• chainguard•cassandra-fips-4.0

  < 4.0.20-r5

• chainguard•cassandra-fips-4.1

  < 4.1.11-r4

• chainguard•commercial-elasticsearch-8.19

  < 8.19.20-r0

• chainguard•commercial-elasticsearch-9.3

  all

• chainguard•commercial-elasticsearch-9.4

  < 9.4.5-r0

• chainguard•commercial-elasticsearch-9.5

  < 9.5.2-r0

• chainguard•confluent-kafka

  < 8.4.0.406-r0

• chainguard•confluent-kafka-jre-bcfips

  < 8.4.0.405-r0

• chainguard•dependency-track-apiserver-5

  < 5.0.4-r2

• chainguard•dependency-track-v4-migrator

  < 5.0.4-r2

• chainguard•druid

  < 37.0.0-r43 | < 37.0.0-r56

• chainguard•eco-java-gradle-8.14.5

  all

• chainguard•eco-java-gradle-9.4.1

  all

• chainguard•eco-java-gradle-9.5.0

  all

• chainguard•eco-java-gradle-9.5.1

  all

• chainguard•eco-java-gradle-9.6.0

  all

• chainguard•eco-java-gradle-9.6.1

  all

• chainguard•eco-java-gradle-9.7.0

  all

Showing first 50 affected entries in server-rendered view.

References (7)

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh
• https://github.com/FasterXML/jackson-databind/issues/6060
• https://github.com/FasterXML/jackson-databind/pull/6056
• https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b
• https://nvd.nist.gov/vuln/detail/CVE-2026-59889
• https://github.com/FasterXML/jackson-databind
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59889.json