StackRadar

CVE-2026-59889

Medium

Advisory

Published 21 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.003
28th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
224
of 17,781 indexed, latest versions
Container images
224
deployed by those charts
Fix available
1 of 1
affected package

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

Carried by container images the latest versions of 224 of 17,781 indexed charts deploy, on 224 images.

Affected packageAffected versionsFixed inImages
jackson-databindmaven2.18.0, 2.18.1, 2.18.2, 2.18.3+17 more2.18.9, 2.21.5, 2.22.1, 3.1.5+1 more224
OSV records
GHSA-5gvw-p9qm-jgwh

Charts affected

224 by stars
ChartLatestAffected imagesRadar Score
mod-service-interactionfolio-org0.1.61 of 1See more

mod-service-interaction folio-org 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
folioci/mod-service-interaction:latestf53c327a48e8
jackson-databind@2.18.7
2.18.9

Open the chart page →

1,733
mod-tagsfolio-org0.1.341 of 1See more

mod-tags folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
folioci/mod-tags:latest6e8beeb70272
jackson-databind@2.21.4
2.21.5

Open the chart page →

342
mod-template-enginefolio-org0.1.341 of 1See more

mod-template-engine folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
folioci/mod-template-engine:latestd105c585da30
jackson-databind@2.18.2
2.18.9

Open the chart page →

818
mod-user-importfolio-org0.1.341 of 1See more

mod-user-import folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
folioci/mod-user-import:latest1807734472bd
jackson-databind@2.18.6
2.18.9

Open the chart page →

1,214
mod-usersfolio-org0.1.341 of 1See more

mod-users folio-org 0.1.34

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
folioci/mod-users:latest6f60033321b0
jackson-databind@2.21.4
2.21.5

Open the chart page →

430
mod-users-blfolio-org0.1.351 of 1See more

mod-users-bl folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
folioci/mod-users-bl:latest4e2d96c9340d
jackson-databind@2.18.2
2.18.9

Open the chart page →

1,321
geysergeyserVerified publisher0.1.31 of 1See more

geyser geyser 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/joffreybvn/k8s-geyser:0.0.247f36880072e
jackson-databind@2.18.0
2.18.9

Open the chart page →

350
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.18.07f6fa1efee8f
jackson-databind@2.18.0
2.18.9

Open the chart page →

49,025
gravitino-iceberg-rest-server-helmgravitino-iceberg-rest-server1.3.111 of 1See more

gravitino-iceberg-rest-server-helm gravitino-iceberg-rest-server 1.3.11

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
apache/gravitino-iceberg-rest:1.3.080136ae753ee
jackson-databind@2.21.3
2.21.5

Open the chart page →

4,556
gridgain9gridgainVerified publisher1.1.101 of 2See more

gridgain9 gridgain 1.1.10

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
gridgain/gridgain9:9.1.1895018390077b
jackson-databind@2.21.0
2.21.5

Open the chart page →

3,199
hello-world-apihello-world-api0.0.51 of 1See more

hello-world-api hello-world-api 0.0.5

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
fabioformosa/hello-world-api:latest063873af085c
jackson-databind@2.18.3
2.18.9

Open the chart page →

1,417
alfiohelmforgeVerified publisher1.2.121 of 3See more

alfio helmforge 1.2.12

1 of the 3 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
alfio/alf.io:2.0-M5-26060c836a081446
jackson-databind@2.21.2
2.21.5

Open the chart page →

2,091
booklorehelmforgeVerified publisher2.0.11 of 3See more

booklore helmforge 2.0.1

1 of the 3 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/booklore-app/booklore:v2.3.1d3d3af34bc2c
jackson-databind@2.21.4
2.21.5

Open the chart page →

2,280
ckanhelmforgeVerified publisher1.3.81 of 6See more

ckan helmforge 1.3.8

1 of the 6 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ckan/ckan-solr:2.11-solr9ef8e5d3e6be1
jackson-databind@2.18.0
2.18.9

Open the chart page →

9,920
jenkinshelmforgeVerified publisher1.0.91 of 1See more

jenkins helmforge 1.0.9

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
jenkins/jenkins:2.568.3-lts-jdk21c1e4c349365f
jackson-databind@3.1.3
3.1.5

Open the chart page →

2,476
kibanahelmforgeVerified publisher1.1.71 of 3See more

kibana helmforge 1.1.7

1 of the 3 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
library/elasticsearch:9.5.19656a9ca03f8
jackson-databind@2.18.8
2.18.9

Open the chart page →

341
komgahelmforgeVerified publisher1.4.151 of 1See more

komga helmforge 1.4.15

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
gotson/komga:1.26.36c2a967bbe9a
jackson-databind@2.21.4
2.21.5

Open the chart page →

2,261
minecrafthelmforgeVerified publisher1.5.31 of 1See more

minecraft helmforge 1.5.3

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
itzg/minecraft-server:2026.9.04e29d14082d9
jackson-databind@3.1.3
3.1.5

Open the chart page →

4,639
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
opensearchproject/opensearch:3.3.2798cf28e226a
jackson-databind@2.18.2
2.18.9

Open the chart page →

25,017
paperlesshpVerified publisher0.1.11 of 5See more

paperless hp 0.1.1

1 of the 5 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
apache/tika:3.3.1.090b7fa1dc018
jackson-databind@2.21.3
2.21.5

Open the chart page →

26,612
ibm-microclimateibm-charts0.1.01 of 8See more

ibm-microclimate ibm-charts 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.5

Open the chart page →

57,669
appswitcher-serverit-at-mOfficialVerified publisher2.0.21 of 1See more

appswitcher-server it-at-m 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
jackson-databind@2.18.3
2.18.9

Open the chart page →

3,774
daveit-at-mOfficialVerified publisher0.2.157 of 11See more

dave it-at-m 0.2.15

7 of the 11 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/dave-admin-portal/dave-adminportal:10.0.0cbff8141302f
jackson-databind@2.21.4
2.21.5
ghcr.io/it-at-m/dave-backend/dave-backend:10.0.0f66413e62afc
jackson-databind@2.21.4
2.21.5
ghcr.io/it-at-m/dave-document-storage/dave-document-storage:10.0.09c7fc07330c9
jackson-databind@2.21.4
2.21.5
ghcr.io/it-at-m/dave-eai/dave-eai:10.0.0fd93e0d125b3
jackson-databind@2.21.2
2.21.5
ghcr.io/it-at-m/dave-frontend/dave-frontend:10.0.0a49fdb8d6f1b
jackson-databind@2.21.4
2.21.5
ghcr.io/it-at-m/dave-geodata-eai/dave-geodata-eai:10.0.06a3fe3136856
jackson-databind@2.21.4
2.21.5
ghcr.io/it-at-m/dave-selfservice-portal/dave-selfserviceportal:10.0.0d352df1b94b6
jackson-databind@2.21.4
2.21.5

Open the chart page →

15,089
zammad-ldap-syncit-at-mVerified publisher0.6.51 of 1See more

zammad-ldap-sync it-at-m 0.6.5

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/zammad-ldap-sync:dev10de22c8cbce
jackson-databind@2.18.2
2.18.9

Open the chart page →

1,345
jx-app-jenkinsjenkins-x0.0.151 of 2See more

jx-app-jenkins jenkins-x 0.0.15

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.5

Open the chart page →

2,476
proxerajfwenischVerified publisher0.12.201 of 1See more

proxera jfwenisch 0.12.20

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/wenisch-tech/proxera:0.12.205ac0e9f6b42f
jackson-databind@2.21.4
2.21.5

Open the chart page →

185
steamcmd-managerjfwenischVerified publisher0.4.51 of 1See more

steamcmd-manager jfwenisch 0.4.5

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/steamcmd-manager:v0.4.5dab685e668d9
jackson-databind@2.18.1
2.18.9

Open the chart page →

6,586
webtoolsjfwenischVerified publisher0.1.41 of 1See more

webtools jfwenisch 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/jfwenisch/webtools:v0.1.44569cae83c70
jackson-databind@2.18.1
2.18.9

Open the chart page →

6,568
k8sforjavak8sforjava0.1.01 of 1See more

k8sforjava k8sforjava 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
vincentgwzhang/k8sforjava:latesta9139f2cd98f
jackson-databind@2.18.2
2.18.9

Open the chart page →

1,476
jenkinskallakruparaju-jenkins1.0.01 of 1See more

jenkins kallakruparaju-jenkins 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.5

Open the chart page →

2,476
jenkinsleechistest2.7.11 of 2See more

jenkins leechistest 2.7.1

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
jenkins/jenkins:ltsc1e4c349365f
jackson-databind@3.1.3
3.1.5

Open the chart page →

4,423
komgalinkding0.2.31 of 1See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
gotson/komga:1.22.0ba892ab3e082
jackson-databind@2.18.1
2.18.9

Open the chart page →

3,131
dependency-trackmediamarktsaturn1.9.21 of 2See more

dependency-track mediamarktsaturn 1.9.2

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
dependencytrack/apiserver:4.14.21ba4f004e1ec
jackson-databind@2.21.1
2.21.5

Open the chart page →

3,818
tinymediamanagermedia-servarrVerified publisher1.6.21 of 2See more

tinymediamanager media-servarr 1.6.2

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
tinymediamanager/tinymediamanager:5.3.22b34dc85099e
jackson-databind@2.21.2
2.21.5

Open the chart page →

7,944
metabase-k8smetabase-k8s1.0.01 of 1See more

metabase-k8s metabase-k8s 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
metabase/metabase:v0.53.4.17807bc5cad17
jackson-databind@2.18.0
2.18.9

Open the chart page →

2,589
activemqmicroboxlabs3.8.01 of 1See more

activemq microboxlabs 3.8.0

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
alfresco/alfresco-activemq:5.18.7-jre17-rockylinux85472f88d9b0b
jackson-databind@2.18.2
2.18.9

Open the chart page →

1,494
nacosnacos-yunyeVerified publisher1.0.31 of 1See more

nacos nacos-yunye 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
nacos/nacos-server:v3.0.130a39cb0c54d
jackson-databind@2.18.3
2.18.9

Open the chart page →

1,783
dependency-tracknaj980.0.91 of 3See more

dependency-track naj98 0.0.9

1 of the 3 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
dependencytrack/apiserver:latestf1da63ed610a
jackson-databind@2.22.0
2.22.1

Open the chart page →

2,465
onyx-stackonyx0.3.11 of 12See more

onyx-stack onyx 0.3.1

1 of the 12 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
vespaengine/vespa:8.526.1569b160f58211
jackson-databind@2.18.3
2.18.9

Open the chart page →

6,338
sentinelopennms-helm-chartsVerified publisher0.4.01 of 2See more

sentinel opennms-helm-charts 0.4.0

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
opennms/sentinel:36.0.288869082a14f
jackson-databind@2.21.3
2.21.5

Open the chart page →

2,024
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
jackson-databind@2.18.3
2.18.9

Open the chart page →

7,792
openshift-integration-operatoropenshift-integration-operatorVerified publisher0.8.21 of 2See more

openshift-integration-operator openshift-integration-operator 0.8.2

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
quay.io/maximilianopizarro/openshift-integration-operator:v0.8.2d6fc43ac802e
jackson-databind@2.21.4
2.21.5

Open the chart page →

2,045
operatonoperatonVerified publisher1.0.51 of 1See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
operaton/operaton:1.0.0-beta-4b35867ffe4d8
jackson-databind@2.18.3
2.18.9

Open the chart page →

2,003
trinoopstty0.2.121 of 1See more

trino opstty 0.2.12

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
trinodb/trino:4815b5e0a97f599
jackson-databind@2.21.3
2.21.5

Open the chart page →

1,158
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
opensearchproject/opensearch:3.1.0474ea3fdf25d
jackson-databind@2.18.2
2.18.9

Open the chart page →

71,208
minecraftpaul1365972-mc3.0.11 of 1See more

minecraft paul1365972-mc 3.0.1

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
itzg/minecraft-server:latest8672e335dbef
jackson-databind@3.1.3
3.1.5

Open the chart page →

4,253
game-serverpvillaverdeVerified publisher1.0.51 of 1See more

game-server pvillaverde 1.0.5

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/itzg/minecraft-server:latestc1a267d9ed6d
jackson-databind@3.1.3
3.1.5

Open the chart page →

4,253
unifiqaoruVerified publisher1.1.21 of 2See more

unifi qaoru 1.1.2

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
linuxserver/unifi-network-application:10.6.101-ls144b6ce6968ee45
jackson-databind@2.21.2
2.21.5

Open the chart page →

3,642
jenkinsquench-jenkinsVerified publisher0.0.81 of 1See more

jenkins quench-jenkins 0.0.8

1 of the 1 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
ghcr.io/quenchworks/images/jenkinsdigest-pinnede92dba4e78c5
jackson-databind@2.22.0
2.22.1

Open the chart page →

79
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2026-59889.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
jackson-databind@2.18.3
2.18.9

Open the chart page →

4,219

Container images carrying it

224 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/kubelauncher/keycloakafe3bd73d7cf
jackson-databind@2.21.2
2.21.5
1
ghcr.io/openccu/openccu:3.89.8.20260719b2de2ff6e8e0
jackson-databind@2.18.2
2.18.9
1
ghcr.io/open-telemetry/demo:3.0.0-kafka0601750a3ca4
jackson-databind@2.21.2
2.21.5
1
ghcr.io/open-telemetry/demo:3.0.0-fraud-detection1cdfd1bcf476
jackson-databind@2.21.2
2.21.5
1
ghcr.io/open-telemetry/demo:3.0.0-ade6c593fe75eb
jackson-databind@2.21.2
2.21.5
1
ghcr.io/openunison/openunison-k8s:1.0.509ad450220ab9
jackson-databind@2.21.3
2.21.5
1
ghcr.io/projectnessie/nessie:0.108.4c0f42874c810
jackson-databind@2.22.0
2.22.1
1
ghcr.io/quenchworks/images/jenkinse92dba4e78c5
jackson-databind@2.22.0
2.22.1
1
ghcr.io/stirling-tools/stirling-pdf:2.14.33b3670fce70b
jackson-databind@3.1.2
3.1.5
1
ghcr.io/streamvisor/streamvisor:4.1.40bc598b2ac9a
jackson-databind@2.21.2
2.21.5
1
ghcr.io/suwayomi/suwayomi-server:v2.3.2320d2c3218c7f9f
jackson-databind@2.22.0
2.22.1
1
ghcr.io/wenisch-tech/chronoreaper:1.1.10447726cec07b
jackson-databind@2.21.3
2.21.5
1
ghcr.io/wenisch-tech/proxera:0.12.205ac0e9f6b42f
jackson-databind@2.21.4
2.21.5
1
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
jackson-databind@2.18.2
2.18.9
1
quay.io/everythingascode/apishift-backend:v0.3.014ff275b2e61
jackson-databind@2.22.0
2.22.1
1
quay.io/keycloak/keycloak:26.60aae0de7fca8
jackson-databind@2.21.2
2.21.5
1
quay.io/keycloak/keycloak:26.3.36a7217a100bd
jackson-databind@2.18.2
2.18.9
1
quay.io/keycloak/keycloak:26.6.39b0330756022
jackson-databind@2.21.2
2.21.5
1
quay.io/maximilianopizarro/custom-rhcl-console:dns-prober-v0.1.21a592ee6651a
jackson-databind@2.21.2
2.21.5
1
quay.io/maximilianopizarro/openshift-integration-operator:v0.8.2d6fc43ac802e
jackson-databind@2.21.4
2.21.5
1
quay.io/maximilianopizarro/showroom-docs-mcp:latest1a6eff92827a
jackson-databind@2.21.2
2.21.5
1
quay.io/poundex/tekton-ci-environment-injector:0.2.46dd65f22949c
jackson-databind@2.21.4
2.21.5
1
quay.io/poundex/tekton-stash-and-cache:0.2.2e854423caa09
jackson-databind@2.21.4
2.21.5
1
quay.io/sshaaf/keycloak-mcp-server:0.4.0b7e9cba72f8a
jackson-databind@2.22.0
2.22.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.