CVE-2026-59889Disclosure

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Full discourse1 post

Abdullah Kareem@CyberKareem92d
Disclosure
New CVE in jackson-databind CVE-2026-59889: JsonView + JsonUnwrapped lets attacker JSON mass-assign admin-only fields under a public view → privilege escalation. A prior fix patched the JsonCreator path; the setter/field sibling never got the guard. #CVE #research #infosec https://t.co/0d3oVjswBO
Post summary
The tweet announces a new CVE (CVE‑2026‑59889) in Jackson‑Databind that enables privilege escalation through misused JsonView and JsonUnwrapped, noting that a prior patch addressed JsonCreator but omitted the setter/field guard.
0001068
235 followersView on X

Explore more

Back to dashboard