CVE-2026-54513

High

Advisory

Published 23 Jun 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: 0.009; 57th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 782; of 17,787 indexed, latest versions
Container images: 771; deployed by those charts
Fix available: 1 of 1; affected package

jackson-databind has an array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Carried by container images the latest versions of 782 of 17,787 indexed charts deploy, on 771 images.

Affected package	Affected versions	Fixed in	Images
jackson-databindmaven	2.10.0, 2.10.1, 2.10.2, 2.10.3+67 more	2.18.8, 2.21.4, 3.1.4	771

OSV records: GHSA-rmj7-2vxq-3g9f

Charts affected

782 by stars

Chart

Latest

Affected images

Radar Score

hertzbeatkubesphere-test

1.4.1

1 of 4 See more

hertzbeat kubesphere-test 1.4.1

1 of the 4 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
apache/iotdb :0.13.3-node	afa47bf1692a	jackson-databind@2.10.5	2.18.8

Open the chart page →

7,749

linstorkvaps

1.14.0

2 of 11 See more

linstor kvaps 1.14.0

2 of the 11 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
ghcr.io/kvaps/linstor-controller :v1.14.0	00ce11c31087	jackson-databind@2.11.4	2.18.8
ghcr.io/kvaps/linstor-satellite :v1.14.0	a573fb9bc809	jackson-databind@2.11.4	2.18.8

Open the chart page →

15,551

drillmagasin-drill

0.9.0

1 of 3 See more

drill magasin-drill 0.9.0

1 of the 3 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
merlos/zookeeper :3.9.3	a38fc7e09ed7	jackson-databind@2.15.2	2.18.8

Open the chart page →

5,741

magentomagento

3.2.3

1 of 12 See more

magento magento 3.2.3

1 of the 12 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
magento/magento-cloud-docker-opensearch :2.5-1.4.0	59fb6f0f1461	jackson-databind@2.14.1	2.18.8

Open the chart page →

13,582

Practica_4_Recuperacion_helmmca-03-02-practica4-recuperacion

1.0.1

1 of 6 See more

Practica_4_Recuperacion_helm mca-03-02-practica4-recuperacion 1.0.1

1 of the 6 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
torrespro/mca-worker :2.0.0	6d3bd305a1ba	jackson-databind@2.10.0	2.18.8

Open the chart page →

19,192

metabasemetabase-helm

2.7.1

1 of 1 See more

metabase metabase-helm 2.7.1

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
metabase/metabase :v0.46.0	9ebdc664a6b2	jackson-databind@2.14.1	2.18.8

Open the chart page →

2,222

clowder2ncsa

1.9.7

2 of 12 See more

clowder2 ncsa 1.9.7

2 of the 12 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
bitnamilegacy/elasticsearch :8.12.2	15d4647fd491	jackson-databind@2.13.4.2	2.18.8
bitnamilegacy/keycloak :20.0.5	cb04e49e6eb1	jackson-databind@2.13.4.2	2.18.8

Open the chart page →

37,441

glowrootnovum-rgi-charts

1.0.10

1 of 2 See more

glowroot novum-rgi-charts 1.0.10

1 of the 2 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
novumrgi/glowroot-central :0.14.0-beta.3	8c54790675b1	jackson-databind@2.13.0	2.18.8

Open the chart page →

2,308

openccuopenccu

3.89.9

1 of 1 See more

openccu openccu 3.89.9

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
ghcr.io/openccu/openccu :3.89.9.20260914	eaeefd355dca	jackson-databind@2.11.4	2.18.8

Open the chart page →

1,405

data-prepperopensearch-project-helm-charts

0.3.1

1 of 1 See more

data-prepper opensearch-project-helm-charts 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
opensearchproject/data-prepper :2.8.0	57c25fa01d3c	jackson-databind@2.17.0	2.18.8

Open the chart page →

1,692

opentelemetry-demoopentelemetry-helm

0.41.1

3 of 34 See more

opentelemetry-demo opentelemetry-helm 0.41.1

3 of the 34 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/demo :3.0.0-kafka	0601750a3ca4	jackson-databind@2.21.2	2.21.4
ghcr.io/open-telemetry/demo :3.0.0-fraud-detection	1cdfd1bcf476	jackson-databind@2.21.2	2.21.4
ghcr.io/open-telemetry/demo :3.0.0-ad	e6c593fe75eb	jackson-databind@2.21.2	2.21.4

Open the chart page →

22,678

opikopik

2.2.61

1 of 13 See more

opik opik 2.2.61

1 of the 13 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
library/zookeeper :3.9.4	dfa9ba46d14b	jackson-databind@2.15.2	2.18.8

Open the chart page →

14,422

todo-apipavanelthepu

0.1.0

1 of 2 See more

todo-api pavanelthepu 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
pavanelthepu/todo-api :1.0.2	f47658e3b24c	jackson-databind@2.12.3	2.18.8

Open the chart page →

2,544

spring-boot-api-apppiomin

0.3.11

1 of 1 See more

spring-boot-api-app piomin 0.3.11

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
piomin/sample-spring-kotlin-microservice :1.1	871f784dd6bc	jackson-databind@2.13.4	2.18.8

Open the chart page →

7,616

portraitportrait

0.2.13

2 of 8 See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
library/elasticsearch :7.17.0	332c6d416808	jackson-databind@2.10.4	2.18.8
treskon/portrait :DEV-latest	88e813f22347	jackson-databind@2.15.1	2.18.8

Open the chart page →

31,949

Jenkinsprasoonjenkins

0.1.0

1 of 1 See more

Jenkins prasoonjenkins 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
jenkins/jenkins :lts	c1e4c349365f	jackson-databind@3.1.3	3.1.4

Open the chart page →

2,487

nifi-registryprofyu

1.14.0-r001

1 of 1 See more

nifi-registry profyu 1.14.0-r001

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
apache/nifi-registry :1.14.0	090b7f87ec7f	jackson-databind@2.12.3	2.18.8

Open the chart page →

4,621

prowlerprowler-app

0.0.9

1 of 5 See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
library/neo4j :2026.02.2	5ab4ab0358cf	jackson-databind@2.20.1	2.21.4

Open the chart page →

8,203

shinyproxyremche

0.6.6

1 of 2 See more

shinyproxy remche 0.6.6

1 of the 2 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
remche/shinyproxy :2.6.1	8bcda8a04d3b	jackson-databind@2.12.6.1	2.18.8

Open the chart page →

3,958

reportportalreportportal-io

26.8.12

2 of 15 See more

reportportal reportportal-io 26.8.12

2 of the 15 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
reportportal/service-api :5.15.4	bf193091525a	jackson-databind@2.21.2	2.21.4
reportportal/service-jobs :5.15.2	99d27d58d6b4	jackson-databind@2.15.4	2.18.8

Open the chart page →

11,943

reservation-appreservation-app

1.0.9

1 of 4 See more

reservation-app reservation-app 1.0.9

1 of the 4 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
zbalogh/reservation-api-server :1.0.9	7c247e399a1f	jackson-databind@2.13.4	2.18.8

Open the chart page →

6,640

resurfaceresurfaceio

3.9.0

1 of 3 See more

resurface resurfaceio 3.9.0

1 of the 3 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
resurfaceio/resurface :3.7.84	d5cda2f64109	jackson-databind@2.18.2	2.18.8

Open the chart page →

7,487

dev-feedrm3l

3.1.2

1 of 3 See more

dev-feed rm3l 3.1.2

1 of the 3 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
rm3l/dev-feed-api :latest	9a7f732245a3	jackson-databind@2.13.4.2	2.18.8

Open the chart page →

9,885

service-names-port-numbersrm3l

0.26.1

1 of 1 See more

service-names-port-numbers rm3l 0.26.1

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
rm3l/service-names-port-numbers :0.12.1	62d1cc4223e5	jackson-databind@2.13.0	2.18.8

Open the chart page →

10,159

elasticsearchromanow-helm-charts

1.7.1

1 of 2 See more

elasticsearch romanow-helm-charts 1.7.1

1 of the 2 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
library/elasticsearch :7.17.8	fdc73b3249c1	jackson-databind@2.10.4	2.18.8

Open the chart page →

6,085

logstashromanow-helm-charts

1.5.0

1 of 1 See more

logstash romanow-helm-charts 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
library/logstash :7.17.8	17a4f64e9cf5	jackson-databind@2.13.2	2.18.8

Open the chart page →

7,567

routrroutr

0.0.10

1 of 2 See more

routr routr 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
fonoster/routr :1.0.0-rc5	2ca65af17cbc	jackson-databind@2.10.0	2.18.8

Open the chart page →

4,983

sentinel-dashboardsentinel-dashboard

0.1.0

1 of 1 See more

sentinel-dashboard sentinel-dashboard 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
royalwang/sentinel-dashboard :1.8.4	df99e2499f91	jackson-databind@2.12.6.1	2.18.8

Open the chart page →

4,287

sentry-k8ssentry-k8s

1.4.1

1 of 11 See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
confluentinc/cp-kafka :7.6.6	83dbca3efd2a	jackson-databind@2.13.5	2.18.8

Open the chart page →

16,194

querysiakhooi

1.0.0

1 of 1 See more

query siakhooi 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
siakhooi/query :1.0.0	f1f4b5b1b870	jackson-databind@3.1.0	3.1.4

Open the chart page →

1,792

clickhousesignoz

24.1.18

1 of 3 See more

clickhouse signoz 24.1.18

1 of the 3 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
signoz/zookeeper :3.7.1	fcc4a3288154	jackson-databind@2.13.2.1	2.18.8

Open the chart page →

4,697

signserver-cesignserver

2.3.5

1 of 1 See more

signserver-ce signserver 2.3.5

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
keyfactor/signserver-ce :7.3.2	798fbbe00283	jackson-databind@2.17.2	2.18.8

Open the chart page →

2,406

ocean-metric-exporterspot

1.1.1

1 of 1 See more

ocean-metric-exporter spot 1.1.1

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
gcr.io/spotinst-artifacts/spot-ocean-metric-exporter :1.0.5	ae57b62291aa	jackson-databind@2.19.2	2.21.4

Open the chart page →

1,482

stardogstardog

3.1.0

1 of 3 See more

stardog stardog 3.1.0

1 of the 3 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
stardog/stardog :latest	2714e5c4b3c1	jackson-databind@2.18.3	2.18.8

Open the chart page →

348

starwhalestarwhale

0.6.15

1 of 4 See more

starwhale starwhale 0.6.15

1 of the 4 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
ghcr.io/star-whale/server :0.6.15	8368359c8dd0	jackson-databind@2.13.2.2	2.18.8

Open the chart page →

13,532

ckanstatcan

0.0.35

1 of 8 See more

ckan statcan 0.0.35

1 of the 8 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
library/solr :8.11.1	8c5f7881cebb	jackson-databind@2.12.3	2.18.8

Open the chart page →

24,984

streamvisorstreamvisor

4.1.6

1 of 1 See more

streamvisor streamvisor 4.1.6

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
ghcr.io/streamvisor/streamvisor :4.1.4	0bc598b2ac9a	jackson-databind@2.21.2	2.21.4

Open the chart page →

2,874

strimzi-drain-cleanerstrimzi

1.6.1

1 of 1 See more

strimzi-drain-cleaner strimzi 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
quay.io/strimzi/drain-cleaner :1.6.1	5fb28e9f30d0	jackson-databind@2.21.2	2.21.4

Open the chart page →

520

strimzi-drain-cleanerstrimzi-drain-cleaner

1.6.1

1 of 1 See more

strimzi-drain-cleaner strimzi-drain-cleaner 1.6.1

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
quay.io/strimzi/drain-cleaner :1.6.1	5fb28e9f30d0	jackson-databind@2.21.2	2.21.4

Open the chart page →

520

jenkinstestchart

0.1.9

1 of 2 See more

jenkins testchart 0.1.9

1 of the 2 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	jackson-databind@2.15.2	2.18.8

Open the chart page →

9,108

jenkinstest-jenkins

9.1.0

1 of 2 See more

jenkins test-jenkins 9.1.0

1 of the 2 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
jenkins/jenkins :2.426.1-jdk11	b470bcdc4ecd	jackson-databind@2.15.2	2.18.8

Open the chart page →

9,108

tocktock

0.6.3

6 of 9 See more

tock tock 0.6.3

6 of the 9 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
tock/bot_admin :25.10.7	df3e38c77a38	jackson-databind@2.20.0	2.21.4
tock/bot_api :25.10.7	dd5d5c70e333	jackson-databind@2.20.0	2.21.4
tock/build_worker :25.10.7	080cb6b08d5b	jackson-databind@2.20.0	2.21.4
tock/duckling :25.10.7	ac1f3f1a1e9c	jackson-databind@2.20.0	2.21.4
tock/kotlin_compiler :25.10.7	c9c0fb40089a	jackson-databind@2.20.0	2.21.4
tock/nlp_api :25.10.7	c04ffe67b977	jackson-databind@2.20.0	2.21.4

Open the chart page →

12,910

wavefront-adapter-for-istiowavefront

0.1.4

1 of 2 See more

wavefront-adapter-for-istio wavefront 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
wavefronthq/proxy :9.2	d1064d28f6eb	jackson-databind@2.11.0	2.18.8

Open the chart page →

15,984

spark-operatorwikimedia

2.2.7

1 of 1 See more

spark-operator wikimedia 2.2.7

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	jackson-databind@2.13.4.2	2.18.8

Open the chart page →

7,883

workflows-aggregatorworkflows-aggregator

0.16.9

1 of 1 See more

workflows-aggregator workflows-aggregator 0.16.9

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/workflows-aggregator :0.16.9	b7984253b128	jackson-databind@2.13.5	2.18.8

Open the chart page →

1,329

accountaccount-service

0.4.2

1 of 1 See more

account account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
vitalii1992/account-service :latest	0e694d94551d	jackson-databind@2.15.0	2.18.8

Open the chart page →

2,168

analyticsaccount-service

0.4.2

1 of 1 See more

analytics account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
vitalii1992/analytics-service :latest	8e798836ecea	jackson-databind@2.15.0	2.18.8

Open the chart page →

2,326

gatewayaccount-service

0.4.2

1 of 1 See more

gateway account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
vitalii1992/api-gateway-service :latest	aabe6ac39356	jackson-databind@2.15.0	2.18.8

Open the chart page →

2,853

keycloakaccount-service

18.4.5

1 of 2 See more

keycloak account-service 18.4.5

1 of the 2 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
quay.io/keycloak/keycloak :17.0.1-legacy	68f9f38c8f30	jackson-databind@2.12.1	2.18.8

Open the chart page →

7,713

orderaccount-service

0.4.2

1 of 1 See more

order account-service 0.4.2

1 of the 1 container images this version deploys carry CVE-2026-54513.

Container image	Digest	Package	Fixed in
vitalii1992/order-service :latest	07c4a8833ce4	jackson-databind@2.15.0	2.18.8

Open the chart page →

2,221

Container images carrying it

771 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
quay.io/keycloak/keycloak :26.6.3	9b0330756022	jackson-databind@2.21.2	2.21.4	1
quay.io/keycloak/keycloak :26.0.6	a93d22e13b86	jackson-databind@2.17.2	2.18.8	1
quay.io/keycloak/keycloak :20.0.3	b8f2a453a17a	jackson-databind@2.13.4.2	2.18.8	1
quay.io/keycloak/keycloak-operator :20.0.2	b1710745fa64	jackson-databind@2.13.4.2	2.18.8	1
quay.io/maximilianopizarro/custom-rhcl-console :dns-prober-v0.1.2	1a592ee6651a	jackson-databind@2.21.2	2.21.4	1
quay.io/maximilianopizarro/neuralbank-backend :latest	a53899fcfc01	jackson-databind@2.20.0	2.21.4	1
quay.io/maximilianopizarro/showroom-docs-mcp :latest	1a6eff92827a	jackson-databind@2.21.2	2.21.4	1
quay.io/maximilianopizarro/workshop-pipelines :latest	e383ba3e0966	jackson-databind@2.15.3	2.18.8	1
quay.io/microcks/microcks-operator :0.0.11	96d1054d4a61	jackson-databind@2.19.2	2.21.4	1
quay.io/newrelic/synthetics-minion :2.2.21	98c26e1b8f70	jackson-databind@2.10.1	2.18.8	1
quay.io/opsmxpublic/ubi8-gate :isd-spin-2025.10.01-5c720954-202511260810	2b3554029737	jackson-databind@2.14.1	2.18.8	1
quay.io/opsmxpublic/ubi8-oes-audit-client :isd-spin-2025.10.01-cb1bfce-202511261037	32a5b1887eab	jackson-databind@2.15.3	2.18.8	1
quay.io/opsmxpublic/ubi8-oes-autopilot :isd-spin-2025.10.01-af26a30d4-202511261054	58bd0bcf72f9	jackson-databind@2.15.3	2.18.8	1
quay.io/opsmxpublic/ubi8-oes-platform :isd-spin-2025.10.01-a7c191ec-202511261122	8ed603ab7417	jackson-databind@2.15.3	2.18.8	1
quay.io/seamware/consent-facade :0.0.14	be844c750c7e	jackson-databind@2.17.2	2.18.8	1
quay.io/snowdrop/spring-boot-rest-http-example :2.7	b1a054613715	jackson-databind@2.13.5	2.18.8	1
quay.io/srcmaxim/gradle-example-app :1.1.3	7c3fc28746ef	jackson-databind@2.12.3	2.18.8	1
quay.io/strimzi/operator :0.45.1	58c727cd2e68	jackson-databind@2.16.2	2.18.8	1
quay.io/strimzi/operator :0.36.1	e9e03b31007c	jackson-databind@2.14.2	2.18.8	1
quay.io/wi_stefan/dss-validation-service :0.0.1	8e928db29ee1	jackson-databind@2.17.2	2.18.8	1
registry.gitlab.com/dyff/workflows-aggregator :0.16.9	b7984253b128	jackson-databind@2.13.5	2.18.8	1