Java Implementation of Hyperledger Fabric Chaincode Shim APIs Exposed to Plaintext Logging

CVE-2026-45581

What is CVE-2026-45581?

The fabric-chaincode-java project has a vulnerability in its logging mechanism when deployed in chaincode-as-a-service mode with TLS enabled. Specifically, from versions 2.3.1 to before 2.5.10, the INFO level logging inadvertently exposes the TLS private key password in plaintext. An attacker who gains access to the chaincode server logs can retrieve this sensitive information. If they also manage to obtain the associated TLS private key, they can potentially impersonate the chaincode server, leading to unauthorized access and further security risks. This vulnerability has been mitigated in version 2.5.10.

References