CVE-2026-54516 describes an issue in jackson-databind's POJOPropertiesCollector._renameProperties() method where a property annotated with @JsonProperty on the getter and @JsonIgnore on the setter is renamed instead of dropped. When MapperFeature.INFER_PROPERTY_MUTATORS is enabled (default), the private backing field remains writable. During deserialization, BeanDeserializerFactory.addBeanProps() detects the field and creates a FieldProperty, allowing an attacker to write directly to the backing field by supplying the renamed JSON key, bypassing the @JsonIgnore on the setter. This vulnerability affects versions from 2.21.0 up to but not including 3.1.4, where it is fixed.

The vulnerability allows an attacker to modify object attributes that should be ignored during deserialization, potentially leading to unauthorized data manipulation. The CVSS score is 5.3 (medium severity) with no confidentiality or availability impact but with integrity impact. There are no known exploits in the wild.

This vulnerability is fixed in jackson-databind version 3.1.4. Users should upgrade to version 3.1.4 or later to remediate this issue. Patch status is not explicitly confirmed in the advisory, but the fix is stated to be in 3.1.4. No other mitigations are indicated.