CVE-2026-41586criticalCWE-502

CVE-2026-41586: critical vulnerability in hyperledger fabric

ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE

Published

Follow this CVE+ Monitor fabric+ Monitor org.hyperledger.fabric-sdk-java:fabric-sdk-java

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.5%
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
hyperledger · fabric
Related CVEs — hyperledger fabric

In the same product, most dangerous first.

CVE-2022-31121HIGHImproper Input Validation in fabric hyperledgerEPSS 2.1%CVE-2022-36023HIGHRemote denial of service in Hyperledger Fabric GatewayEPSS 1.2%CVE-2023-46132HIGHCrosslinking transaction attack in hyperledger/fabricEPSS 0.5%