CVE-2026-59888: 
Java vulnerability analysis and mitigation

CVE-2026-59888 is an authorization bypass vulnerability in FasterXML jackson-databind where @JsonIgnore annotations on Java Record properties can be circumvented when a PropertyNamingStrategy is in use. Discovered by Omkhar Arasaratnam and published on July 10, 2026, it affects jackson-databind versions >= 2.15.0 < 2.18.8, >= 2.19.0 < 2.21.4, and >= 3.0.0 < 3.1.4. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly). Downstream IBM products including CICS Transaction Gateway Desktop Edition, CICS Transaction Gateway for Multiplatforms, IBM ApplinX, and IBM App Connect for Manufacturing are also affected (IBM Advisory).

The root cause (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) lies in the ordering of operations within POJOPropertiesCollector during JSON deserialization. Specifically, _removeUnwantedIgnorals() registers a @JsonIgnore-annotated Record component under its original implicit field name before _renameUsing() applies the configured PropertyNamingStrategy; as a result, _ignoredPropertyNames retains only the pre-rename name, and _ignorableProps is built from this stale key. When the renamed JSON key (e.g., internal_role for a field named internalRole under SnakeCaseStrategy) arrives in a crafted payload, IgnorePropertiesUtil.shouldIgnore() does not recognize it as ignored and passes it through to the Record's constructor parameter, defeating the @JsonIgnore protection (GitHub Advisory, Fix Commit). The fix, applied in PR #5974, adds a check in _renameUsing() to propagate the ignore status to the renamed key via _collectIgnorals(rename) whenever the original name was in _ignoredPropertyNames (Fix Commit). This vulnerability is exploitable remotely with no authentication or user interaction required, targeting any application that deserializes JSON into Java Records using both @JsonIgnore and a PropertyNamingStrategy.

Successful exploitation allows an unauthenticated remote attacker to assign values to Record constructor parameters that are intended to be protected from external input via @JsonIgnore, resulting in low confidentiality and low integrity impact with no availability impact (GitHub Advisory). A concrete example is a role or privilege flag on a Record that an application assumes cannot be set by untrusted clients — an attacker can supply the renamed JSON key (e.g., internal_role) to elevate privileges or alter application state during deserialization. The scope is limited to applications specifically using Java Records with both a PropertyNamingStrategy and @JsonIgnore on sensitive fields; standard POJO classes are not affected by this code path (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.247% (16th percentile), indicating a low near-term probability of exploitation (GitHub Advisory). NVD's supplemental data classifies the vulnerability as automatable with partial technical impact and no known exploitation (Feedly). No threat actor attribution has been reported.

1. Identify target application: Locate a Java application that uses jackson-databind (versions 2.15.0–2.18.7, 2.19.0–2.21.3, or 3.0.0–3.1.3) to deserialize JSON into Java Records, where the Record uses both a PropertyNamingStrategy (e.g., SnakeCaseStrategy) and @JsonIgnore on a sensitive field.
2. Determine the renamed key: Identify the @JsonIgnore-annotated field name (e.g., internalRole) and compute its renamed form under the active naming strategy (e.g., internal_role under SnakeCaseStrategy).
3. Craft malicious JSON payload: Construct a JSON payload that includes the renamed key with a desired value, such as {"username":"alice","internal_role":"ADMIN"}.
4. Submit payload: Send the crafted JSON to any API endpoint or input that triggers deserialization of the target Record type — no authentication is required if the endpoint is public.
5. Achieve bypass: The renamed key bypasses the @JsonIgnore check and is bound to the Record's constructor parameter, setting the protected field (e.g., internalRole = "ADMIN") in the resulting object (GitHub Advisory, Fix Commit).

• Network: Unexpected JSON payloads containing snake_case (or otherwise renamed) keys corresponding to fields that should be ignored (e.g., internal_role, is_admin, privilege_level) in requests to API endpoints that accept JSON.
• Logs: Application logs showing deserialized Record objects with non-null values in fields that should always be null or default (e.g., privilege/role fields populated from external input); jackson-databind debug logs (if enabled) showing unexpected property binding for @JsonIgnore-annotated fields.
• Application Behavior: Unexpected privilege escalation or altered application state in objects deserialized from user-supplied JSON, particularly in Java Record types using naming strategies.

Upgrade jackson-databind to one of the patched versions: 2.18.8, 2.21.4, or 3.1.4 (GitHub Advisory). For Maven projects, update the com.fasterxml.jackson.core:jackson-databind or tools.jackson.core:jackson-databind dependency accordingly. If immediate patching is not possible, review all Java Record types that use both a PropertyNamingStrategy and @JsonIgnore, and consider replacing @JsonIgnore with explicit allow-listing of accepted fields using @JsonProperty or input validation layers. IBM product users should apply the relevant IBM security bulletins for CICS Transaction Gateway Desktop Edition, CICS Transaction Gateway for Multiplatforms, IBM ApplinX, and IBM App Connect for Manufacturing (IBM Advisory, IBM ApplinX).

The vulnerability was reported by Omkhar Arasaratnam and the fix was developed collaboratively with the jackson-databind maintainer (cowtowncoder), who characterized the severity as "minor" while the reporter rated it "Moderate" — reflecting a difference in perspective on real-world exploitability (GitHub Advisory). The Apache Spark project promptly upgraded to jackson-databind 2.21.4 in response to this and related CVEs (PR #5974). SUSE issued a security update (SUSE-SU-2026:3273-1) for affected jackson packages, and openSUSE published a corresponding security announcement, indicating broad ecosystem awareness (Feedly).