CVE-2026-54518
MediumAdvisory
Published 23 Jun 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.004
- 29th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 103
- of 17,781 indexed, latest versions
- Container images
- 98
- deployed by those charts
- Fix available
- 1 of 1
- affected package
jackson-databind has a @JsonView bypass for unwrapped creator parameters
Carried by container images the latest versions of 103 of 17,781 indexed charts deploy, on 98 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jackson-databindmaven | 2.21.0, 2.21.1, 2.21.2, 2.21.3+5 more | 2.21.4, 3.1.4 | 98 |
- OSV records
- GHSA-rcqc-6cw3-h962
Charts affected
103 by stars
Container images carrying it
98 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| jenkins/ | c1e4c349365f | jackson-databind | 3.1.4 | 13 |
| public.ecr.aws/ | 8e01c0305844 | jackson-databind | 2.21.4 | 7 |
| apache/ | 77e3df905404 | jackson-databind | 2.21.4 | 2 |
| gisaia/ | e612fc722e02 | jackson-databind | 2.21.4 | 2 |
| gisaia/ | f667e0ee79be | jackson-databind | 2.21.4 | 2 |
| gisaia/ | 4e693e7b6f37 | jackson-databind | 2.21.4 | 2 |
| graviteeio/ | 05fd67a93056 | jackson-databind | 2.21.4 | 2 |
| graviteeio/ | 27374522cd04 | jackson-databind | 3.1.4 | 2 |
| metabase/ | 9491ed11c901 | jackson-databind | 2.21.4 | 2 |
| nacos/ | 1c191c30c8cd | jackson-databind | 2.21.4 | 2 |
| ghcr.io/ | 896fc7b18b1b | jackson-databind | 2.21.4 | 2 |
| ghcr.io/ | 7cda86a33344 | jackson-databind | 2.21.4 | 2 |
| ghcr.io/ | f4feb3323a29 | jackson-databind | 2.21.4 | 2 |
| quay.io/ | 5fb28e9f30d0 | jackson-databind | 2.21.4 | 2 |
| acryldata/ | 99513cc1c45e | jackson-databind | 2.21.4 | 1 |
| acryldata/ | c3db54d8fb94 | jackson-databind | 2.21.4 | 1 |
| adeptiainc/ | f1087da3da0b | jackson-databind | 2.21.4 | 1 |
| alfio/ | 0c836a081446 | jackson-databind | 2.21.4 | 1 |
| apache/ | 80136ae753ee | jackson-databind | 2.21.4 | 1 |
| apache/ | 90b7fa1dc018 | jackson-databind | 2.21.4 | 1 |
| confluentinc/ | 0ad069035863 | jackson-databind | 2.21.4 | 1 |
| confluentinc/ | f0cfd047a839 | jackson-databind | 2.21.4 | 1 |
| consensys/ | 3a4f5761ae1c | jackson-databind | 3.1.4 | 1 |
| consensys/ | f146a51a1ba3 | jackson-databind | 2.21.4 | 1 |
| dependencytrack/ | 1ba4f004e1ec | jackson-databind | 2.21.4 | 1 |
| eginnovations/ | e4dfe242fe9f | jackson-databind | 2.21.4 | 1 |
| epamedp/ | 49e8fe9c4855 | jackson-databind | 2.21.4 | 1 |
| erudikaltd/ | 949c56b57e8f | jackson-databind | 3.1.4 | 1 |
| folioci/ | e760dbb81d1a | jackson-databind | 3.1.4 | 1 |
| folioci/ | eedfcbc29792 | jackson-databind | 3.1.4 | 1 |
| folioci/ | 1ef654ee9f23 | jackson-databind | 3.1.4 | 1 |
| folioci/ | 682b852e056d | jackson-databind | 3.1.4 | 1 |
| folioci/ | 15ef73b1abd0 | jackson-databind | 3.1.4 | 1 |
| folioci/ | 0cc86bf09755 | jackson-databind | 3.1.4 | 1 |
| folioci/ | f1d7caf4544b | jackson-databind | 3.1.4 | 1 |
| folioci/ | 1ad1811c9b37 | jackson-databind | 3.1.4 | 1 |
| folioci/ | 3ae8cb99daa3 | jackson-databind | 3.1.4 | 1 |
| folioci/ | cfd6109bf477 | jackson-databind | 3.1.4 | 1 |
| folioci/ | 5f3358ccaa0f | jackson-databind | 2.21.4 | 1 |
| folioci/ | e46892405fde | jackson-databind | 3.1.4 | 1 |
| geonode/ | 81b1d431b7e9 | jackson-databind | 2.21.4 | 1 |
| geoservercloud/ | de0b20bd2a43 | jackson-databind | 3.1.4 | 1 |
| geoservercloud/ | b04ed89b5d2b | jackson-databind | 2.21.4 | 1 |
| geoservercloud/ | 318254b52f96 | jackson-databind | 3.1.4 | 1 |
| geoservercloud/ | 4f077124f591 | jackson-databind | 2.21.4 | 1 |
| geoservercloud/ | 4f91e3048ac8 | jackson-databind | 2.21.4 | 1 |
| geoservercloud/ | 299f0d6232d1 | jackson-databind | 3.1.4 | 1 |
| geoservercloud/ | 5164f687ce4d | jackson-databind | 2.21.4 | 1 |
| graviteeio/ | 07b7f6dc267a | jackson-databind | 2.21.4 | 1 |
| graviteeio/ | a8eb04ee0c70 | jackson-databind | 2.21.4 | 1 |