Java Deserialization Vulnerability in Hyperledger Fabric by Hyperledger
CVE-2026-41586

9.3CRITICAL

Key Information:

Vendor

Hyperledger

Status
Fabric
Vendor
CVE Published:
7 May 2026

What is CVE-2026-41586?

Hyperledger Fabric, a leading enterprise-grade permissioned distributed ledger framework, contains a vulnerability in the Channel.java component. This issue arises from the implementation of the readObject() method, which uses untrusted byte arrays without the necessary ObjectInputFilter configuration while invoking the deSerializeChannel() method. This insufficient filtering facilitates a design flaw typical of Java deserialization vulnerabilities, allowing potential remote code execution. As of now, there are no available patches to remediate this issue, making it critical for users to assess their security posture and implement protective measures.

Affected Version(s)

fabric >= 1.0.0, <= 2.2.26

References

https://github.com/hyperledger/fabric/security/advisories...
x_refsource_CONFIRM
https://hyperledger.github.io/fabric-gateway
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.