CVE-2026-59888: 
Java vulnerability analysis and mitigation

CVE-2026-59888 is an authorization bypass vulnerability in FasterXML jackson-databind where @JsonIgnore annotations on Java Record properties can be circumvented when a PropertyNamingStrategy is configured. Discovered by Omkhar Arasaratnam (@omkhar) and published on July 10, 2026, it affects com.fasterxml.jackson.core:jackson-databind versions >= 2.15.0 < 2.18.8, >= 2.19.0 < 2.21.4, and tools.jackson.core:jackson-databind versions >= 3.0.0 < 3.1.4. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Feedly).

The root cause (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) lies in the ordering of operations within POJOPropertiesCollector: _removeUnwantedIgnorals() registers a @JsonIgnore-annotated Record component under its original implicit name into _ignoredPropertyNames before _renameUsing() applies the configured PropertyNamingStrategy. After renaming, _ignoredPropertyNames still holds only the pre-rename key, so _ignorableProps is built from a stale entry. Consequently, IgnorePropertiesUtil.shouldIgnore() does not recognize the renamed JSON key (e.g., internal_role for a field named internalRole with SnakeCaseStrategy) as ignored, and the value is bound to the Record's constructor parameter. The fix, applied in PR #5974 (commit baa2cdf for 3.x, backport c7c6783 for 2.18.x), adds a check inside _renameUsing() to propagate the ignore status to the renamed key via _collectIgnorals(rename) (Github Advisory, Fix Commit).

An unauthenticated remote attacker can send a crafted JSON payload containing the naming-strategy-renamed key of a @JsonIgnore-annotated Record field, causing jackson-databind to populate that field during deserialization despite the ignore annotation. This allows unauthorized modification of fields intended to be protected from external input — such as internal roles, privilege flags, or other sensitive constructor parameters — leading to low-severity confidentiality and integrity impacts. Availability is not affected, and the scope is unchanged, but the practical risk depends heavily on what data the bypassed field controls in the target application (Github Advisory, Feedly).

1. Identify target: Locate a Java application that uses jackson-databind in an affected version range and deserializes JSON into Java Records annotated with both @JsonNaming (or a globally configured PropertyNamingStrategy) and @JsonIgnore on one or more Record components.
2. Determine the renamed key: Identify the @JsonIgnore-annotated Record field name (e.g., internalRole) and compute its renamed form under the configured strategy (e.g., SnakeCaseStrategy → internal_role).
3. Craft the payload: Construct a JSON payload that includes the renamed key with a desired value alongside legitimate fields, e.g., {"username":"alice","internal_role":"ADMIN"}.
4. Send the request: Submit the crafted JSON to the application endpoint that deserializes into the vulnerable Record type (e.g., via HTTP POST with Content-Type: application/json).
5. Achieve bypass: Jackson-databind, due to the stale ignore-list, passes IgnorePropertiesUtil.shouldIgnore() for the renamed key and assigns the attacker-controlled value to the Record constructor parameter, bypassing the @JsonIgnore restriction (Github Advisory, Fix Commit).

• Network: Unexpected JSON payloads containing naming-strategy-renamed keys (e.g., snake_case variants) for fields that should never appear in client-supplied input; anomalous POST requests to deserialization endpoints with extra JSON keys not part of the documented API contract.
• Logs: Application logs showing unexpected values in @JsonIgnore-annotated Record fields (e.g., privilege escalation flags set to non-default values); deserialization audit logs recording unknown or unexpected field assignments.
• Application Behavior: Privilege escalation or unexpected role assignments in application logic that relies on @JsonIgnore-protected Record fields; business logic anomalies where internal-only fields appear to be externally controlled.

Upgrade jackson-databind to one of the patched versions: 2.18.8, 2.21.4 (for the 2.x line), or 3.1.4 (for the 3.x line). If immediate patching is not possible, review all Java Record types that use a PropertyNamingStrategy and @JsonIgnore together, and consider adding explicit input validation or replacing @JsonIgnore with alternative access controls (e.g., custom deserializers or DTO patterns that do not expose sensitive fields). Apache Spark has already addressed this by upgrading to Jackson 2.21.4 (Github Advisory, Fix PR).

The vulnerability was reported by Omkhar Arasaratnam (@omkhar) and rated as "minor" by the jackson-databind maintainer (cowtowncoder) but "Moderate" by the reporter; the GitHub Advisory Database assigned it Moderate severity. OpenSUSE issued a security announcement covering this CVE as part of package updates, and Tenable published Nessus detection plugins (IDs 327129 and 328924). No significant broader media coverage or notable social media discussion has been observed beyond standard vulnerability tracking feeds (Github Advisory, Feedly).