StackRadar

CVE-2026-59889

Medium

Advisory

Published 21 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
224
of 17,781 indexed, latest versions
Container images
224
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

Carried by container images the latest versions of 224 of 17,781 indexed charts deploy, on 224 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.18.0, 2.18.1, 2.18.2, 2.18.3+17 more2.18.9, 2.21.5, 2.22.1, 3.1.5+1 more224
OSV records
GHSA-5gvw-p9qm-jgwh

Charts affected

224 by stars
ChartLatestAffected imagesRadar Score
strimzi-kafka-operatorradar-baseVerified publisher0.46.01 of 1See more

strimzi-kafka-operator radar-base 0.46.0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jackson-databind@2.18.3
2.18.9

Open the chart page →

1,951
komgarubxkubeVerified publisher0.1.31 of 1See more

komga rubxkube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
gotson/komga:1.26.36c2a967bbe9a
jackson-databind@2.21.4
2.21.5

Open the chart page →

2,261
stirling-pdfrubxkubeVerified publisher0.1.21 of 1See more

stirling-pdf rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
jackson-databind@3.1.2
3.1.5

Open the chart page →

6,207
suwayomirubxkubeVerified publisher0.1.21 of 1See more

suwayomi rubxkube 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/suwayomi/suwayomi-server:v2.3.2320d2c3218c7f9f
jackson-databind@2.22.0
2.22.1

Open the chart page →

1,610
keycloakself-hosters-by-nightVerified publisher0.1.11 of 1See more

keycloak self-hosters-by-night 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.60aae0de7fca8
jackson-databind@2.21.2
2.21.5

Open the chart page →

518
showroom-docs-mcpshowroom-docs-mcpVerified publisher2.1.01 of 4See more

showroom-docs-mcp showroom-docs-mcp 2.1.0

1 of the 4 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/showroom-docs-mcp:latest1a6eff92827a
jackson-databind@2.21.2
2.21.5

Open the chart page →

5,201
keycloaksikalabs0.1.01 of 1See more

keycloak sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
quay.io/keycloak/keycloak:26.3.36a7217a100bd
jackson-databind@2.18.2
2.18.9

Open the chart page →

1,690
bootzookasoftwaremillVerified publisher0.2.11 of 2See more

bootzooka softwaremill 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
softwaremill/bootzooka:latest845b5e8f8056
jackson-databind@3.1.1
3.1.5

Open the chart page →

3,003
hazelcaststakaterVerified publisher1.0.21 of 1See more

hazelcast stakater 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
hazelcast/hazelcast:latestf086bf0ecb23
jackson-databind@2.21.2
2.21.5

Open the chart page →

1,702
jenkinsstakaterVerified publisher0.21.01 of 1See more

jenkins stakater 0.21.0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.5

Open the chart page →

2,476
teku-validatorstakewise4.3.21 of 2See more

teku-validator stakewise 4.3.2

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
consensys/teku:25.4.1bf6ecd2ea716
jackson-databind@2.18.3
2.18.9

Open the chart page →

3,153
tekton-ci-environment-injectortekton-ci-environment-injectorVerified publisher0.2.41 of 1See more

tekton-ci-environment-injector tekton-ci-environment-injector 0.2.4

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
jackson-databind@2.21.4
2.21.5

Open the chart page →

510
tekton-stash-and-cachetekton-stash-and-cacheVerified publisher0.2.21 of 1See more

tekton-stash-and-cache tekton-stash-and-cache 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
jackson-databind@2.21.4
2.21.5

Open the chart page →

1,082
tikatikaVerified publisher0.3.01 of 1See more

tika tika 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
jackson-databind@2.21.1
2.21.5

Open the chart page →

1,825
jenkinstnh2.7.11 of 2See more

jenkins tnh 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.5

Open the chart page →

4,423
openunison-operatortremolo3.0.301 of 1See more

openunison-operator tremolo 3.0.30

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/openunison/openunison-kubernetes-operator:1.0.11f4feb3323a29
jackson-databind@2.21.3
2.21.5

Open the chart page →

2,126
orchestratremolo3.1.552 of 5See more

orchestra tremolo 3.1.55

2 of the 5 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/openunison/openunison-k8s:1.0.509ad450220ab9
jackson-databind@2.21.3
2.21.5
ghcr.io/openunison/openunison-kubernetes-operator:1.0.11f4feb3323a29
jackson-databind@2.21.3
2.21.5

Open the chart page →

7,637
kafkatwomartensVerified publisher0.2.11 of 2See more

kafka twomartens 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
confluentinc/cp-kafka:latest0ad069035863
jackson-databind@2.21.2
2.21.5

Open the chart page →

1,551
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
wazuh/wazuh-indexer:4.14.49c344d2b1757
jackson-databind@2.18.2
2.18.9

Open the chart page →

5,484
jenkinswebencryptor1.9.181 of 1See more

jenkins webencryptor 1.9.18

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.5

Open the chart page →

2,476
metabasewiremindVerified publisher2.27.5-wiremind01 of 1See more

metabase wiremind 2.27.5-wiremind0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
jackson-databind@2.21.2
2.21.5

Open the chart page →

1,639
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
jackson-databind@2.18.0
2.18.9

Open the chart page →

9,381
language-toolzekker6Verified publisher1.12.11 of 2See more

language-tool zekker6 1.12.1

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
erikvl87/languagetool:6.7-dockerupdate-3e1ea6a975388
jackson-databind@2.18.0
2.18.9

Open the chart page →

1,571
zipkinzipkinVerified publisher0.5.01 of 1See more

zipkin zipkin 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
openzipkin/zipkin-slim:3.6.0a69e1057df36
jackson-databind@2.21.2
2.21.5

Open the chart page →

1,159

Container images carrying it

224 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
payara/micro:7.2026.2-jdk25fb44b8ce1cb2
jackson-databind@2.21.0
2.21.5
1
payara/server-full:7.2026.2-jdk2531f1253f0cf8
jackson-databind@2.21.0
2.21.5
1
penpotapp/backend:2.17.2770b55f6e51b
jackson-databind@2.22.0
2.22.1
1
reportportal/service-api:5.15.4bf193091525a
jackson-databind@2.21.2
2.21.5
1
reportportal/service-authorization:5.15.16a954407b417
jackson-databind@2.21.4
2.21.5
1
resurfaceio/resurface:3.7.84d5cda2f64109
jackson-databind@2.18.2
2.18.9
1
scmmanager/scm-manager:3.12.1bfb766050f34
jackson-databind@2.21.1
2.21.5
1
siakhooi/query:1.0.0f1f4b5b1b870
jackson-databind@3.1.0
3.1.5
1
softwaremill/bootzooka:latest845b5e8f8056
jackson-databind@3.1.1
3.1.5
1
stardog/stardog:latest2714e5c4b3c1
jackson-databind@2.18.3
2.18.9
1
sysnet4admin/colosseum-agg:logbc25b152d88e
jackson-databind@2.18.2
2.18.9
1
tchiotludo/akhq:0.28.0c2824dc2ae44
jackson-databind@3.1.3
3.1.5
1
thingsboard/tb-postgres:latest2d17e4e36edc
jackson-databind@2.18.4
2.18.9
1
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
jackson-databind@2.21.2
2.21.5
1
traccar/traccar:6.7-alpine621c8d6d46fd
jackson-databind@2.18.2
2.18.9
1
trinodb/trino:4801565e8cac299
jackson-databind@2.21.2
2.21.5
1
trinodb/trino:4815b5e0a97f599
jackson-databind@2.21.3
2.21.5
1
vespaengine/vespa:8.526.1569b160f58211
jackson-databind@2.18.3
2.18.9
1
vincentgwzhang/k8sforjava:latesta9139f2cd98f
jackson-databind@2.18.2
2.18.9
1
wazuh/wazuh-indexer:4.14.49c344d2b1757
jackson-databind@2.18.2
2.18.9
1
wazuh/wazuh-indexer:4.14.3b149b30da686
jackson-databind@2.18.2
2.18.9
1
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
jackson-databind@2.21.4
2.21.5
1
ghcr.io/bysamio/casepack-api:0.31.00eb3ad229c2c
jackson-databind@2.21.4
2.21.5
1
ghcr.io/comet-ml/opik/opik-backend:2.2.5950a7aa0562f5
jackson-databind@2.21.4
2.21.5
1
ghcr.io/devops-ia/cp-schema-registry:8.1.1-msk-iam-auth2.3.530d1a445acc7
jackson-databind@2.18.3
2.18.9
1
ghcr.io/eximeebpms/eximeebpms-bpm-platform:run-1.3.0acb8dbce38fd
jackson-databind@3.0.4
3.1.5
1
ghcr.io/gla-rad/enav-api-gateway:latest8f4345c77dda
jackson-databind@3.1.0
3.1.5
1
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
jackson-databind@2.21.2
2.21.5
1
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
jackson-databind@2.21.2
2.21.5
1
ghcr.io/gla-rad/enav-aton-service-client:latestf1629ac5f9ec
jackson-databind@3.1.2
3.1.5
1
ghcr.io/gla-rad/enav-ckeeper:latest415323ef112b
jackson-databind@2.21.2
2.21.5
1
ghcr.io/gla-rad/enav-eureka:latest05002092c621
jackson-databind@2.21.2
2.21.5
1
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
jackson-databind@2.21.2
2.21.5
1
ghcr.io/gla-rad/enav-vdes-controller:latestc4c52955814f
jackson-databind@2.21.2
2.21.5
1
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
jackson-databind@2.18.3
2.18.9
1
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
jackson-databind@2.21.4
2.21.5
1
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
jackson-databind@2.21.4
2.21.5
1
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
jackson-databind@2.21.4
2.21.5
1
ghcr.io/it-at-m/dave-eai/dave-eai:10.0.0fd93e0d125b3
jackson-databind@2.21.2
2.21.5
1
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
jackson-databind@2.21.4
2.21.5
1
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai:10.0.06a3fe3136856
jackson-databind@2.21.4
2.21.5
1
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
jackson-databind@2.21.4
2.21.5
1
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
jackson-databind@2.18.2
2.18.9
1
ghcr.io/itzg/minecraft-server:latestc1a267d9ed6d
jackson-databind@3.1.3
3.1.5
1
ghcr.io/jfwenisch/ipfix-generator:latesta1b05567dbf6
jackson-databind@2.21.2
2.21.5
1
ghcr.io/jfwenisch/steamcmd-manager:v0.4.5dab685e668d9
jackson-databind@2.18.1
2.18.9
1
ghcr.io/jfwenisch/webtools:v0.1.44569cae83c70
jackson-databind@2.18.1
2.18.9
1
ghcr.io/joffreybvn/k8s-geyser:0.0.247f36880072e
jackson-databind@2.18.0
2.18.9
1
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
jackson-databind@2.18.2
2.18.9
1
ghcr.io/kenchrcum/tika:3.3.0-full708446bc6783
jackson-databind@2.21.1
2.21.5
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.