CVE-2026-54517 Jackson-Databind @JsonView Bypass Vulnerability Analysis

Technical summary

CVE-2026-54517 is a property-visibility bypass in jackson-databind affecting versions 2.21.0–2.21.3 and 3.1.0–3.1.3. The root cause is incomplete @JsonView enforcement in BeanDeserializer._deserializeUsingPropertyBased. While creator properties respect the active-view filter, the regular property-buffering code path skips the visibleInView() check. A recent change to SetterlessProperty.isMerging() that returns true routes setterless Collection and Map properties through this unguarded deserialization path. Consequently, a restricted collection property annotated with @JsonView can be deserialized and populated from untrusted JSON input even when the active view should exclude it, violating the intended access-control semantics.

Business impact

Organizations relying on Jackson's @JsonView feature to enforce role-based or context-based data filtering in REST APIs face a data-integrity risk. An attacker can inject or modify collection-typed properties that an API was designed to hide from them, potentially leading to unauthorized state changes, privilege escalation, or data leakage depending on the affected properties. This is particularly concerning in multi-tenant or role-separated API endpoints where @JsonView is used as a primary isolation mechanism.

Affected systems

jackson-databind versions 2.21.0 through 2.21.3 and 3.1.0 through 3.1.3 are vulnerable. The issue does not affect versions prior to 2.21.0 or 3.1.0. Applications using these versions in deserialization workflows with @JsonView-annotated collection or map properties lacking setters are at risk. No other Jackson components (e.g., streaming parser, annotations module) are directly affected.

Exploitability

Exploitability is straightforward: an attacker needs only network access to an affected application and knowledge that a @JsonView-restricted collection property exists. No special privileges, authentication bypass, or user interaction are required. The attack surface is high for any REST API or microservice using Jackson to deserialize JSON payloads. However, the impact is limited to integrity of specific properties; confidentiality is not compromised. CVSS 5.3 (MEDIUM) reflects the moderate severity: low complexity, no authentication needed, but integrity impact only.

Remediation

Upgrade jackson-databind to version 2.21.4 or 3.1.4 or later. Both versions contain the fix restoring @JsonView validation to all property deserialization paths. Organizations should prioritize this update for applications using @JsonView annotations to enforce access control, especially those in production. After patching, no configuration changes are required.

Patch guidance

Jackson releases security patches via Maven Central and GitHub releases. Verify your current jackson-databind version (check pom.xml, gradle.build, or dependency-lock files). Update to 2.21.4 or 3.1.4 as appropriate for your major version line. Test in a staging environment to confirm compatibility, particularly if custom deserializers or view filters are in use. Consider automated dependency scanning (e.g., Maven Dependency Check or OWASP Dependency-Check) to detect similar issues going forward.

Detection guidance

Review application code for @JsonView annotations on collection or map properties. Enable debug logging on BeanDeserializer to observe which properties are deserialized and against which views. Monitor inbound JSON payloads for unexpected properties matching your restricted field names. Correlation of request source with view context may reveal anomalies. Post-patch, verify that no payloads bypass view filters by performing integration tests with deliberately restricted views and crafted payloads.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The MEDIUM severity and straightforward fix (version bump) make it lower priority than critical RCE issues, but @JsonView-reliant APIs should not delay. Organizations with strict role-based data separation should prioritize more highly; those not using @JsonView annotations can defer slightly. Rapid patching reduces exposure to both known and opportunistic exploitation.

Risk score, explained

CVSS 5.3 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), no authentication requirement (PR:N), no user interaction (UI:N), and integrity impact only (I:L). The score appropriately captures a moderate, practical integrity risk without elevation to severity. The lack of confidentiality or availability impact prevents a higher score despite the relative ease of exploitation.

Frequently asked questions