PT-2026-41961 · Hyperledger+1 · Fabric-Chaincode-Java+1

Published 2026-05-19 · Updated 2026-06-08 · CVE-2026-45581

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions fabric-chaincode-java versions 2.3.1 through 2.5.9

Description When chaincode is deployed in chaincode-as-a-service mode with TLS enabled, the chaincode server INFO level logging includes the TLS private key password in plaintext. An attacker with access to the chaincode server logs could recover this password and, if they also obtain the TLS private key, impersonate the chaincode server.

Recommendations Update to version 2.5.10. Redact or remove existing logs that contain the TLS private key password. Change the TLS private key password. Restrict the logging level to WARNING or higher to prevent INFO level logs from being written.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-45581

GHSA-WG5X-3G47-V38R

Affected Products

Fabric-Chaincode-Java

Org.Hyperledger.Fabric-Chaincode-Java:Fabric-Chaincode-Shim

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-45581 · Security Note
• https://osv.dev/vulnerability/GHSA-wg5x-3g47-v38r · Vendor Advisory
• https://github.com/hyperledger/fabric-chaincode-java · Note
• https://github.com/hyperledger/fabric-chaincode-java/security/advisories/GHSA-wg5x-3g47-v38r · Note
• https://reddit.com/r/VulnMatter/comments/1ths5us/resumen_diario_de_vulnerabilidades_19052026 · Reddit Post