CVE-2026-41586
criticalHyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications.
Vendor / product: Hyperledger — fabric
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.
CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-05-07 06:16
Modified: 2026-10-26 21:10
NVD status: Analyzed
Last synced 2 days ago
Verified against the source API 2026-10-27 07:07 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
hyperledger / fabric ≥1.0.0 ≤2.2.26
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7
Patch / mitigation: https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7
References
- https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 security-advisories@github.com
- https://hyperledger.github.io/fabric-gateway security-advisories@github.com
- https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 07:07 UTC · record ↗