PT-2026-37132 · Hyperledger · Fabric-Sdk-Java+1

Brodmart · Published 2026-04-29 · Updated 2026-05-11 · CVE-2026-41586

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hyperledger Fabric versions 1.0.0 through 2.2.26

Description In the deprecated fabric-sdk-java client SDK, the Channel.java file implements readObject() and exposes the deSerializeChannel() function, both of which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This creates a Java deserialization issue where an attacker who can supply crafted serialized Channel bytes—such as by compromising a local channel file or injecting data through an application—can achieve remote code execution (RCE) via gadget chain exploitation. This is a client-side issue and does not involve data transmitted from Fabric peers.

Recommendations Migrate to org.hyperledger.fabric:fabric-gateway, which does not use Java serialization. As a temporary workaround for the deprecated SDK, add an ObjectInputFilter to whitelist only expected classes within the deSerializeChannel() function.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BIT-HYPERLEDGER-FABRIC-ORDERER-2026-41586

BIT-HYPERLEDGER-FABRIC-PEER-2026-41586

BIT-HYPERLEDGER-FABRIC-TOOLS-2026-41586

CVE-2026-41586

GHSA-PRF8-CF2X-RHX7

Affected Products

Hyperledger Fabric

Fabric-Sdk-Java

References · 12

• 🔥 https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 · Exploit
• https://osv.dev/vulnerability/BIT-hyperledger-fabric-tools-2026-41586 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hyperledger-fabric-orderer-2026-41586 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-prf8-cf2x-rhx7 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-hyperledger-fabric-peer-2026-41586 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41586 · Security Note
• https://github.com/hyperledger/fabric · Note
• https://github.com/hyperledger/fabric-sdk-java · Note
• https://twitter.com/CVEnew/status/2052400805475651823 · Twitter Post
• https://twitter.com/NewsNerdie/status/2052388502306803875 · Twitter Post
• https://hyperledger.github.io/fabric-gateway · Note
• https://t.me/CVEtracker/52950 · Telegram Post