CVE-2026-41586 PUBLISHED

ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE

Assigner: GitHub_M
Reserved: 21.04.2026 Published: 07.05.2026 Updated: 07.05.2026

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 9.3

Product Status

Vendor hyperledger
Product fabric
Versions
  • Version >= 1.0.0, <= 2.2.26 is affected

References

Problem Types

  • CWE-502: Deserialization of Untrusted Data CWE