CVE-2026-41586CWE-502insecure-deserialization

CVE-2026-41586

Critical · published May 7, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes deSerializeChannel() which call ObjectInputStream.readObject() on untrusted byte arrays without configuring an ObjectInputFilter. This is a classic Java deserialization RCE pattern. At time of publication, there are no publicly available patches.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00631 · 49.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-05-07T10:16Z
Affected products (1)
ProductVersionsFixed in
hyperledger/fabric≥ 1.0.0, ≤ 2.2.26—
References (3)
https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 · [email protected]https://hyperledger.github.io/fabric-gateway · [email protected]https://github.com/hyperledger/fabric/security/advisories/GHSA-prf8-cf2x-rhx7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 MAY 05:12Z
    ObjectInputStream.readObject() without ObjectInputFilter in fabric-sdk-java allows Java deserialization RCE
    cvelistv5